The CRA, from "does it apply to us?" to a technical file you can stand behind.
Most of the Cyber Resilience Act applies from 11 December 2027. Article 14 reporting has applied since 11 September 2026. SkyQon takes a manufacturer through the questions in their order: does it apply, in which class, what is missing, and what to write down. Free where it can be free, fixed-price where it cannot.
Not legal advice. SkyQon does not certify products, test them or declare conformity: the manufacturer declares, and a notified body is involved for some classes.
Three dates
The Regulation entered into force on 10 December 2024 and applies in full from 11 December 2027 (Art. 71(2)). Two parts arrived earlier: Chapter IV on notified bodies has applied since 11 June 2026, and the Article 14 reporting obligations since 11 September 2026.
Products placed on the market before 11 December 2027 fall under the other obligations only if they are substantially modified after that date (Art. 69(2)). Article 14 reporting applies to them regardless (Art. 69(3)): an actively exploited vulnerability in a product you shipped years ago already starts a 24-hour clock today.
Scope
Who is in scope, in plain words
The Regulation applies to products with digital elements made available on the EU market whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Art. 2(1)). A product with digital elements is software or hardware and its remote data processing solutions, including software or hardware components placed on the market separately (Art. 3(1)).
You are the manufacturer if you develop or manufacture such a product, or have it designed, developed or manufactured, and market it under your own name or trademark, whether for payment or free of charge (Art. 3(13)). Making available on the market means any supply for distribution or use in the course of a commercial activity, whether in return for payment or free of charge (Art. 3(22)). Software you give away as part of a commercial activity counts.
The main exclusions
- Medical devices, in vitro diagnostic medical devices and vehicles already covered by their own Union type-approval rules (Art. 2(2)).
- Aviation products that hold a certificate issued under the Union's civil aviation rules (Art. 2(3)); aviation-adjacent products without one are a case for the free check.
- Marine equipment under the Union's marine equipment rules (Art. 2(4)).
- Products covered by other Union rules with an equivalent level of protection, carved out by delegated act (Art. 2(5)). No such act has been adopted (checked 12 November 2026).
- Spare parts made only to replace identical components, to the same specifications (Art. 2(6)).
- Products developed or modified exclusively for national security or defence purposes, or designed to process classified information (Art. 2(7)).
Three cases the text does not settle in one line: open-source software supplied outside a commercial activity is not caught, monetised or commercially supported open source can be, and a foundation may fall under the lighter steward regime (Recitals 17 to 19, Art. 3(14), Art. 24); an importer or distributor who sells under its own name becomes the manufacturer (Art. 21); and a product substantially modified after 11 December 2027 is treated as newly placed on the market (Art. 3(30), Art. 69(2)). The free check answers those with "unclear, talk to us" and the article, not with a guess.
The journey, in order
Each step answers the question the next one needs. Start where you are; the first two are free and need no account.
- 1. Free scope and class checkA few questions per product: your role, the exclusions, what the product is, whether it is supplied commercially, the Annex III or Annex IV category, your company size, the standards you apply and when the product reached the market. You get the applicable articles and a candidate class, or "unclear" with the reason. Run the check.
- 2. Free reporting self-checkTwelve questions on the Article 14 procedure, scored on the page: who becomes aware, who files, which CSIRT, what evidence you keep. Take the self-check.
- 3. The 24-Hour Reporting KitThe rehearsed Article 14 procedure, the five filing templates, user notices in four languages and a 90-minute drill script, installed in one week. Launch price €99. See the kit.
- 4. The Incident Reporting add-onThe 24-hour, 72-hour and final-report clocks running in the dashboard, with pre-filled drafts and a filing record that can only be added to. You file; SkyQon keeps the time and the record. See Incident Reporting.
- 5. CRA Applicability & Gap Assessment, €3,500A written applicability and classification conclusion per product with the articles cited, a gap list against Annex I Part I and Part II and the Article 13 duties, a plan in priority order, and a signed report in your evidence chain. See the assessment.
- 6. CRA Implementation Sprint, from €5,000The technical documentation skeleton, the user information, the declaration draft you sign, the SBOM and vulnerability-handling process, the disclosure policy and security.txt, secure-update evidence and the support period. Quoted at the end of the assessment. See the sprint.
- 7. CRA Product Evidence in the dashboardThe product register, the gap assessment per product with evidence files, the signed product evidence report, SBOM matching, the vulnerability-handling log, secure-update evidence and the document drafts, as an add-on to Pro and above with Incident Reporting included. See the seven modules.
Services
Two fixed-scope services
Delivered by the team that wrote and rehearsed SkyQon's own Article 14 procedure. Both end in evidence you keep; neither ends in a certificate.
The add-on
In the dashboard
CRA Product Evidence keeps the assessment and the sprint as a living record rather than a folder: seven modules and one signed report per product, on the same evidence chain as your NIS2 work.
How it works, in four steps
- 1. Register and classifyAdd each product, record your role and answer the classification questions. The class and the articles behind it are stored with the product.
- 2. Upload the SBOMOne CycloneDX or SPDX file per version. SkyQon checks the components every day against OSV.dev and the NVD, and adds CISA KEV and EPSS to each match.
- 3. Handle what is foundTriage each match, record why it does or does not affect you, keep the intake log and publish advisories. A known-exploited match offers to start the Article 14 clock; a person decides.
- 4. Keep the evidenceMark each Annex I requirement in place, partial or planned with files attached, generate the document drafts, and seal a signed report per product.
The seven modules
- Product register. Each product with digital elements, its role (manufacturer, own brand, importer), its class (default, important class I or II, critical), the conformity route, the support period and the intake channel. The classification applies the same cited rules as the free check and is stored per product.
- Gap assessment per product. Every requirement of Annex I Part I and Part II and every Article 13 duty with a status (in place, partial, planned, or not applicable with the written justification Article 13(4) asks for), an owner, a due date, evidence files (PDF, images, text) and the full history.
- Signed CRA Product Evidence report. Per product and period: the statuses, the evidence hashes and the classification, on your existing hash-chained evidence chain and verifiable on the public verify page like every SkyQon report. The NIS2 evidence report gains a per-product section. Rows are manufacturer-declared and recorded by SkyQon, never verified by SkyQon.
- SBOM. Upload a CycloneDX or SPDX file (JSON) per product version, history kept. Components are matched daily against OSV.dev and the NVD and enriched with CISA KEV and FIRST EPSS; alerts for vulnerable and known-exploited components. Only package identifiers leave the platform. A known-exploited match offers a one-click start of the Article 14 reporting clock; a person decides, nothing starts by itself.
- Vulnerability handling. The coordinated vulnerability disclosure policy on record, a security.txt check, an intake and remediation log with a timestamp per stage (received, triaged, fix in progress, fixed, advisory published), and security advisories drafted and exported as Markdown or HTML.
- Secure updates. Per product: the update mechanism, whether security updates are separate and free, the availability period (Article 13(9), ten years), the code-signing identity (a certificate issued through Private CA Management or one you upload) and the TLS posture of the update endpoint.
- Document builder. The Annex VII technical documentation (with the SME simplified layout, flagged as a format the Commission has not yet adopted under Article 33(5): every element is still required), the Annex II user information and the Annex V EU declaration of conformity draft, generated from the register, editable, exported as Word with the banner "DRAFT: the manufacturer signs; SkyQon does not declare conformity". Versions kept.
Start with the free scope and class check, rehearse reporting with the kit, get the answer in writing from the assessment, close the gaps in the sprint, and keep the record in the add-on. Ask about the add-on.
Integrations
Works with
The SBOM formats and vulnerability sources the add-on reads, and the tools the rest of SkyQon sends to.
- CycloneDX
- SPDX
- OSV.dev
- NVD
- CISA KEV
- FIRST EPSS
- Slack
- Microsoft Teams
- PagerDuty
- n8n
- Webhooks
- Splunk
- Microsoft Sentinel
- Jira (by email)
- ServiceNow (by email)
- HaloPSA
- Vanta
- Drata
- AWS Certificate Manager
- Cloudflare
- Amazon Route 53
- Azure DNS
- EJBCA
- Microsoft AD CS
- HashiCorp Vault
- AWS Private CA
- Any OIDC or SAML provider, such as Okta or Microsoft Entra ID
- SCIM
Every connection listed is built into SkyQon today. Product names belong to their owners.
Said before you start
What SkyQon does not do
- Certify, test or declare. The manufacturer draws up the EU declaration of conformity (Art. 28) and affixes the CE marking (Art. 30). A notified body is involved for important products without applied harmonised standards and for class II products (Art. 32). SkyQon produces evidence and documents; it does not carry out a conformity assessment.
- File your reports. The kit and the add-on keep the procedure, the clocks and the record. You submit on ENISA's single reporting platform.
- Give legal advice. Not legal advice. Contested scope questions belong with your counsel; our written conclusions cite the articles so that conversation is short.
Common questions
Does the CRA apply to software we give away?
It can. Making available on the market means supply in the course of a commercial activity, whether in return for payment or free of charge (Art. 3(22)). Free software supplied as part of a commercial activity is in; open-source software supplied outside one is not, and Recitals 17 to 19 draw that line. The free check flags this as a case to talk through.
Which class is our product in?
Most products are in the default category and the manufacturer assesses them itself (Art. 32(1)). Products listed in Annex III are important, class I or class II (Art. 7); products listed in Annex IV are critical (Art. 8). Implementing Regulation (EU) 2025/2392 gives the technical descriptions of each category. Embedding a listed component does not by itself put the product that contains it in that category.
Can we self-assess an important class I product?
Only by applying harmonised standards, common specifications or a European cybersecurity certification scheme that cover the requirements (Art. 32(2)). No harmonised standard for the CRA has been cited in the Official Journal yet (checked 12 November 2026), so today a class I product needs a notified body. A class II product always does (Art. 32(3)).
Do we have to report for a product that predates the Regulation?
Yes, under Article 14. Products placed on the market before 11 December 2027 are caught by the other obligations only if substantially modified after that date (Art. 69(2)), but the reporting obligations apply to them since 11 September 2026 (Art. 69(3)).
Are small companies treated differently?
In two places. Micro and small enterprises are exempt from fines for missing the 24-hour early-warning deadline (Art. 64(10)(a)), and they may use a simplified technical documentation form once the Commission adopts it (Art. 33(5)). That form has not been adopted yet, and every element of Annex VII is still required.
Official text: Regulation (EU) 2024/2847 · Read the full CRA guide
Start with the free check
Ten minutes per product, the articles cited, and a clear "unclear" where the text does not decide. Then book the assessment if you want the answer in writing.