Part 2: EU Cyber Resilience Act (CRA) - 6 Core Elements Companies Must Establish for CRA Compliance

✅ Practical Checklist for Non-Important PDE Manufacturers

1. CRA Enforcement – What It Means for Your Company

The Cyber Resilience Act (CRA) officially entered into force on December 10, 2024.

The obligations apply in stages on concrete dates: vulnerability and incident reporting obligations have applied since September 11, 2026, and the remaining obligations apply in full from December 11, 2027.

CRA is not a certification task, but a structural transformation that requires organizations to redesign how they plan, design, develop, operate, and maintain their digital products. The real question today is: “Do we have the foundational capability to comply with CRA?”

This article summarizes the six essential elements companies must prepare, based specifically on CRA requirements for Non-Important PDEs (Products with Digital Elements).

2. 6 Core Elements for CRA Readiness

3. Detailed Breakdown of Core Elements

1) Cybersecurity Risk Assessment

2) Essential Security Requirements

CRA defines general security and vulnerability management obligations.

General Security Requirements (Annex I – Part 1)

Vulnerability Management (Annex I – Part 2)

ℹ️ CVD (Coordinated Vulnerability Disclosure) ensures vulnerabilities are handled promptly and responsibly through structured collaboration between manufacturers, customers, partners, and researchers.

3) User Instructions

Security information must be transparently communicated to users, while manufacturers are responsible for documenting and managing how security, design, and vulnerability handling are implemented throughout the product lifecycle.

User Instructions (Annex II) — Documentation that must be provided to users

4) Technical Documentation

Annex VII – Documentation to be retained ‘internally’

5) EU Declaration of Conformity

Manufacturers must issue a DoC for each product, include compliance evidence, and keep it for at least 10 years.

6) Reporting Obligations

1) If an actively exploited vulnerability is identified (mandatory reporting)

: 3-phase submission to CSIRT & ENISA

2) In the event of a serious security incident (mandatory reporting)

: 3-phase submission to CSIRT & ENISA

3) Mandatory user notification

• Users must be informed immediately if they are impacted

• Instructions must be provided in a machine-readable format (e.g., JSON)

• If the manufacturer fails to notify users in time, CSIRT may issue the warning directly

4) Voluntary reporting (optional)

• Vulnerabilities not yet exploited

• Potential threats

• Near-miss cybersecurity events

• Can be submitted voluntarily to CSIRT and/or ENISA

4. What Companies Must Start Now

CRA is not a one-time certification exercise — it fundamentally requires security to be embedded across the entire product lifecycle (planning → design → development → release → operation → retirement).

This shift toward lifecycle-based cybersecurity demands a structural transformation.

“Conduct proper risk assessment, implement secure-by-default design, maintain comprehensive documentation, and establish responsible incident and vulnerability reporting mechanisms.”

Four practical priorities:

1. Risk Assessment + Secure-by-Design

   • Re-align all functions and architecture based on risk assessment and core security requirements.

2. SBOM-based vulnerability management system

   • Track all components, libraries, and open-source dependencies and automate patch management.

3. Standardize templates for User Instructions & Technical Documentation

   • Establish internal documentation formats to prevent omissions and reduce repeated manual work.

4. Prepare a reporting response process (24h/72h rule)

   • Clearly define who reports, what is reported, and through which channels in case of a vulnerability or incident.

Time until CRA full enforcement is limited — the earliest preparation is the most strategic response.

📌 Need support with CRA strategy or documentation preparation?

Requirements vary depending on product type, target market, and development stage.

ZIEN’s security and regulatory experts provide practical support

— from product structure analysis and documentation templates to full CRA compliance strategy.

🔗 Ready to explore options? Get in touch — we’re here to help: https://zi-en.io/company/contact-us