CRA Regulatory Updates

The platform is live: register your Assigned Representative(s) with MFA-enabled EU Login and rehearse the notification workflow using the SRP Reporting Wizard and the official AR User Manual before you need to submit a real notification.

Review the draft ETSI standard(s) matching your product category now — the texts are public even before final adoption — and track them in the Harmonised Standards Tracker. Do not treat draft-stage standards as a presumption of conformity until an OJEU citation follows.

Prepare EU Login and Primary/Backup Assigned Representative responsibilities, identify your designated national CSIRT, and rehearse the SRP submission workflow. Register when an actual notification needs to be submitted and consult ENISA guidance for updates.

Use the release gates as a practical review layer: store an SBOM per release, run security scans, time-bound risk exceptions, review sensitive changes, sign artifacts, and verify critical suppliers.

Treat the 17 fields as a recommended SBOM quality baseline while retaining the CRA legal minimum separately. Add hashes, relationships, authorship, signatures, and generation metadata where available.

Review the Annex to C(2026) 5252 for clarifications on scope (remote data processing / FOSS), substantial modification, and support-period determination that may affect your product classification and documentation.

If you require a third-party Notified Body (Class I or Class II products), verify your chosen CAB is seeking or has received designation under these requirements.

Review the draft product lists and submit feedback by the consultation deadline. Reclassification to Class II triggers mandatory third-party assessment.

Use the updated ENISA guidance to complete or review your secure development documentation.

Review your VDP to ensure it covers the CSIRT notification workflow described in the draft.

Monitor the JTC 21 drafts — aligning with the emerging standard now reduces future rework.

Review the draft guidance and submit feedback if your product sits in a grey area (e.g., B2B-only software, embedded components, open-source projects).

Complete your Technical File (Annex VII) and SBOM before September 2026.

Validate your SBOM against this checklist using the SBOM Analyzer.

Monitor the delegated acts — your product classification may change.

Use the Assessment to determine your classification and compliance roadmap.

Update your incident response plan to account for CSIRT delay scenarios — do not assume immediate cross-border propagation of your early warning.

Re-check your product classification against the definitive list in Reg. 2025/2392. Class II and Critical products require third-party Notified Body assessment — this cannot be self-assessed.

Add EUVD (euvd.enisa.europa.eu) to your vulnerability monitoring workflow. Check it before determining whether Article 14 reporting is triggered.