CART
EU CRA Toolkit delivers 74 ready-to-use Microsoft Office templates covering Regulation (EU) 2024/2847 as consolidated on 20 November 2024 — the Article 14 reporting cascades that apply from 11 September 2026, the thirteen Annex I Part I product properties and eight Part II vulnerability handling requirements, the software bill of materials, classification against Annex III and Annex IV, conformity assessment and CE marking, the Article 13(8) support period and the update-availability duty that outlives it, and the Annex VII technical documentation. Built for manufacturers of products with digital elements who need a file a notified body can actually review.
$99.00
✓ In stock — instant download after checkout
The Cyber Resilience Act is the first horizontal cybersecurity law for products. It does not care what sector you sell into — if your product has digital elements and connects to anything, it applies.
Most CRA material you will find is written against the Regulation as adopted, and stops at the December 2027 date. That is the wrong date to be planning against, and it is not the only one.
This toolkit is written against a dated text — Regulation (EU) 2024/2847 as consolidated on 20 November 2024 — and every one of its 74 documents states that on its cover.
Article 14 applies from 11 September 2026. Not December 2027. From that date, a manufacturer that becomes aware of an actively exploited vulnerability in its product has 24 hours to file an early warning with the CSIRT coordinator and ENISA, 72 hours to file the notification, and 14 days after a fix is available to file the final report. A severe incident runs a parallel cascade with a different final-report deadline — one month from the notification, not 14 days from the fix.
And Article 69(3) applies that duty to products placed on the market before 11 December 2027. Article 69(2) says a legacy product only takes on the rest of the Regulation if it is substantially modified. Article 69(3) then derogates: the reporting obligations apply to all in-scope products already on the market, modified or not.
That is the provision most manufacturers will miss, because “applies from 11 December 2027” reads as “applies to what we ship next”. It does not. A product you shipped in 2023 and no longer develop can generate a 24-hour reporting obligation next month.
The toolkit gives that its own document — a legacy product readiness assessment that asks the only three questions that matter for reporting: can you detect it, can you report it, can you tell users. It carries worked examples including a discontinued product with no monitoring and no user channel, where the honest answer is a recorded acceptance of the exposure by top management.
This is the finding that will cost the most money, and it is not visible from a plain reading of Annex III.
Article 32(2) lets an important class I product self-assess only where harmonised standards, common specifications or a European cybersecurity certification scheme exist and are applied in full — *or* it pushes the product to a notified body where such instruments do not exist.
As at 14 August 2026, none exists. We established that on four independent checks: an EUR-Lex legislation search returning only the Regulation itself; the Regulation’s own EUR-Lex record showing no implementing acts; the absence of any Commission harmonised-standards page for this Regulation; and a search for the CEN/CENELEC standardisation request. The third is the strongest — the Commission opens a per-instrument standards page as soon as the first citation lands.
So on today’s position all 19 Annex III class I categories, all 4 class II categories and all 3 Annex IV critical categories require third-party conformity assessment. Class II never had a self-assessment route in any case.
There is exactly one way around it, and the toolkit states it. Article 32(5) lets a product qualifying as free and open-source software use any Article 32(1) procedure — including module A self-assessment — provided the technical documentation is made available to the public at the time of placing on the market. Publishing the Annex VII file is the price of self-assessment. For an open-source project that is often acceptable. For a proprietary product it is not available at all.
Chapter IV — notified body designation — has applied since 11 June 2026, so bodies can already be designated. Capacity is new and every manufacturer faces the same December 2027 deadline.
| From | What applies |
|---|---|
| 11 June 2026 | Chapter IV — designation of conformity assessment bodies. Already in force |
| 11 September 2026 | Article 14 reporting — and it reaches the installed base |
| 11 December 2027 | Everything else — essential requirements, conformity assessment, CE marking, user information |
| 11 June 2028 | EU type-examination certificates issued under *other* Union harmonisation legislation cease to be valid |
Every document in the pack carries the date that governs it in its front matter, and section 09 is the only section that takes the earlier one.
Not the handful the summaries list. The toolkit works through every one, and three of them are routinely missed because they read as administrative:
Under Article 64, non-compliance with Annex I, Article 13 or Article 14 sits in the top penalty tier — up to EUR 15,000,000 or 2.5% of total worldwide annual turnover, whichever is higher. The administrative paragraphs above carry the same maximum as shipping an insecure product.
Article 2(2) excludes products covered by the Medical Device Regulation and the In Vitro Diagnostic Regulation from the CRA outright. They are not an alternative compliance route — such a product is not a CRA product at all.
The boundary is drawn tightly, and the toolkit works it through: Annex III class I item 19 catches personal wearables with a health monitoring purpose to which those regulations do not apply. A consumer fitness tracker that is not a medical device is an important class I product here. The two outcomes are mutually exclusive and the determination has to say which applies.
The heaviest section is reporting and incident response (9 documents), because Article 14 is the obligation that bites first and the one buyers arrive looking for. It separates the two cascades properly, fixes the moment of awareness as a recorded determination — every deadline runs from it, and it is the first thing an authority will test — and carries the Article 14(7) cascade for manufacturers with no main establishment in the Union.
Economic operators, essential requirements and vulnerability handling carry 8 documents each. The essential requirements checklist ships all thirteen Annex I Part I properties plus the general obligation, and insists on the columns that fail review: whether the requirement applies, in what manner, how it is implemented, and a precise evidence reference. “Implemented in the codebase” is not one.
The vulnerability handling section covers the eight Annex I Part II requirements including the software bill of materials, the coordinated disclosure policy that Part II (5) requires to be *enforced* and not merely published, and the Article 13(6) duty to report a component vulnerability upstream and share the fix — an obligation to contribute back that is unusual in product regulation and that most manufacturers have no record of at all.
| # | Section | Documents |
|---|---|---|
| 01 | Programme and Scope | 4 |
| 02 | Economic Operators | 8 |
| 03 | Qualification and Classification | 5 |
| 04 | Essential Cybersecurity Requirements | 8 |
| 05 | Vulnerability Handling | 8 |
| 06 | Cybersecurity Risk Assessment | 4 |
| 07 | Technical Documentation | 5 |
| 08 | Conformity Assessment and CE Marking | 6 |
| 09 | Reporting and Incident Response | 9 |
| 10 | Support Period and Updates | 4 |
| 11 | User Information and Instructions | 3 |
| 12 | Market Surveillance and Enforcement | 3 |
| 13 | Mapping Audit and Evidence | 7 |
39 organisation documents and 35 per-product documents. The distinction matters: a per-product document maintained once for a portfolio does not evidence anything about an individual product, and the register records which is which.
The CRA’s currency risk runs the opposite way to a standards-based toolkit. The risk is not that something is superseded — it is that the landscape fills in. A first citation in the *Official Journal* flips nineteen class I categories from notified-body assessment to a self-assessment option overnight.
So every dated and volatile fact sits in one document — the Regulatory Currency Supplement — with the four checks, the delegated and implementing acts that do not yet exist, the Commission guidance required by Article 26 that has not been published, and a monthly watch log that records negative findings as well as changes. A change is a one-document edit, not a pack-wide sweep.
An information security management system governs how you protect yourself. This Regulation governs the security properties of what you ship. The toolkit ships a cross-reference matrix whose useful column is not the overlap but the gap — the obligations with no ISMS counterpart at all: the reporting deadlines, the support period, update availability, upstream contribution, the support end date at the point of purchase, and Annex I Part I (2)(i), which protects other people’s devices and networks rather than yours.
A separate interface guide covers the AI Act and NIS2, so that one incident is not reported twice in conflicting terms — and records Article 12(3), which stops an Annex III or Annex IV product reaching a lighter cybersecurity assessment by routing through the AI Act’s internal-control procedure.
A set of 74 editable Microsoft Word and Excel templates covering Regulation (EU) 2024/2847, the Cyber Resilience Act — 61 documents and 13 workbooks across thirteen sections, from qualification and classification through the essential cybersecurity requirements, vulnerability handling, conformity assessment and CE marking, to Article 14 reporting and market surveillance.
Regulation (EU) 2024/2847 as consolidated on 20 November 2024. The Regulation has not been amended since. Every document states the consolidation on its cover.
11 September 2026 for the Article 14 reporting obligations, including for products you have already placed on the market. 11 December 2027 for everything else. Chapter IV, which governs notified body designation, has applied since 11 June 2026.
For reporting, yes. Article 69(3) applies Article 14 to all in-scope products placed on the market before 11 December 2027. The rest of the Regulation reaches a legacy product only if it is substantially modified from that date.
If your product falls in Annex III or Annex IV, on today’s position yes — because no harmonised standard has been cited in the *Official Journal* under this Regulation, so the Article 32(2) self-assessment condition cannot be met. The exception is Article 32(5) for free and open-source software where the technical documentation is published at placing on the market. Default-tier products self-assess under module A.
No, and they do not overlap. Article 2(2) excludes medical devices and in vitro diagnostic medical devices from the CRA outright. If your product is a medical device you need the medical device pack instead; if it is a consumer wearable that is not a medical device, this is the right one.
Yes. Annex I Part II (1) requires an SBOM in a commonly used, machine-readable format covering at the very least the top-level dependencies. The toolkit covers depth, format, per-release generation, and the two provisions that make it externally visible — Annex VII point 8 and Article 13(25), under which a market surveillance authority may request it for a Union-wide dependency assessment unconnected to any suspicion about your product.
No. An ISMS and this Regulation govern different things, and certification confers no presumption of conformity under the CRA. The toolkit maps the two and identifies the gap.
Covered in three places: the Article 24 obligations of an open-source software steward, which is an actor class with no analogue in the MDR, IVDR, NIS2 or the AI Act; the Article 13(5) due diligence duty over open-source components not made available commercially; and the Article 32(5) conformity route.
Microsoft Word (.docx) and Microsoft Excel (.xlsx). 61 Microsoft Word documents and 13 Microsoft Excel workbooks. Fully editable, with no macros and no licence keys.
No. Regulation (EU) 2024/2847 is published free of charge on EUR-Lex in all 24 official languages, so the toolkit quotes article and annex numbers directly and you can check any of them in one click.
Reviews
There are no reviews yet