Timeline
The reporting obligations in Article 14 apply from 11 September 2026. The rest of the Regulation applies from 11 December 2027.
Regulation (EU) 2024/2847 · CRA
Prepare for the Cyber Resilience Act based on your role and product class.
Tell Audexa whether you manufacture, import, distribute or steward open-source software, and which class your product falls into. You only see the controls that apply to you: essential requirements, vulnerability handling, SBOM, reporting to ENISA, technical documentation and CE marking, with an action plan to close each gap.
- 67 controls in 10 sections
- Profile by role and product class
- Mappings to ISO 27001 and NIS2
CRA self-assessmentManufacturer · Important class I
47%
Readiness levelSample data
- Essential requirements (Annex I, Part I)58%
- Vulnerability handling (Annex I, Part II)44%
- SBOM and support period36%
- Reporting to ENISA and CSIRT52%
- Technical documentation and conformity39%
67 controls with how to assess them and how to meet them
10 sections, from product scope to market surveillance
57 mappings to ISO/IEC 27001:2022
44 mappings to NIS2 to reuse what you already have
What the CRA requires
Cybersecurity becomes a condition for selling your product in the EU.
The Cyber Resilience Act sets cybersecurity requirements for products with digital elements, from design to the end of the support period. Obligations depend on each operator's role and the product's class.
Essential requirements
Annex I sets requirements for the product (secure by default, data protection, updates) and for vulnerability handling throughout the support period.
Reporting
Manufacturers report actively exploited vulnerabilities and severe incidents through the single reporting platform, with an early warning within 24 hours and a notification within 72 hours.
Product class
Important products in class I and II and critical products follow stricter conformity assessment routes than default products.
Documentation and CE marking
Technical documentation, EU declaration of conformity and CE marking before the product is placed on the market.
Importers and distributors
They must check that the product complies, carries the CE marking and documentation, and act when they spot a risk.
Sources: Regulation (EU) 2024/2847 (EUR-Lex)
How Audexa helps
From product profile to action plan.
The same workflow as every other Audexa audit, adapted to companies that place digital products on the European market.
Scope
Only what applies to you.
Profile question
Pick one or more roles and the product class, and see how many questions your questionnaire will have.
Applicability with a reason
Mark which controls apply, which do not and which are out of scope, and record why.
What you already have
When you create the audit you see how much your ISO 27001 or NIS2 audits already cover.
Assess and act
Every gap with its next step.
Guided questionnaire
Yes, Partial, No or Not applicable for each control, with guidance on how to assess it.
How to meet each control
Concrete steps, expected evidence, suggested owner, closure criterion and when to review it.
Task plan
Findings turned into tasks with subtasks, owners and dates.
Prove
All your evidence in one place.
Evidence vault
SBOMs, test reports, reporting procedures or technical documentation, with review and expiry dates.
Policies
A library of 67 templates. 6 are linked to the CRA: “Product Security and Coordinated Vulnerability Disclosure Policy”, “Product Conformity and CE Marking Procedure (CRA)”, “Secure Development Policy”, “Vulnerability and Patch Management Policy”, “Regulatory Incident Notification Procedure” and “Procedure for Handling Authority Requests and Data Disclosure”. They are a starting point to adapt and approve.
Reports and re-audits
Score, findings and a PDF and Excel report. Assess again and compare progress.
Some features depend on your plan and active modules.
Profile question
A manufacturer and a distributor don't answer the same questions.
Before the questionnaire you state your role, and you can tick several because many companies manufacture some products and import or distribute others. Then you choose the class of your main product, which sets the conformity assessment route. If you don't know it yet, start with the product unclassified and change it later.
- Roles: manufacturer, importer, distributor, open-source software steward
- Classes: unclassified (default), important class I, important class II or critical
- A section to classify the product if you haven't done it yet
- Number of questions shown before you start
Product profileCRA
- ManufacturerSelected
- ImporterSelected
- DistributorNo
- Product classImportant class I
Reporting
Vulnerabilities and incidents, with clear deadlines.
One section checks whether you can detect an actively exploited vulnerability or a severe incident and report it through the single reporting platform to the coordinating CSIRT and ENISA. Another covers vulnerability handling: SBOM, coordinated disclosure, security updates and the support period.
- Early warning, notification and final report
- Informing affected users
- SBOM and declared support period
- Mappings to NIS2 to reuse your incident procedure
CRA reportingArt. 14
- Early warning24 h
- Notification72 h
- Final report14 days after the fix
- Approved procedureValid evidence
How it works
Three steps to prepare for the CRA.
Set the profile
Choose your roles and the product class, and see how much your existing work covers.
Answer with guidance
Assess the controls that apply and review the answers proposed from ISO 27001 or NIS2.
Execute and re-audit
Work through the task plan, gather evidence and assess again before each milestone.
Plans
Available from the Premium plan.
The Cyber Resilience Act is included in Premium and Diamond. It is not part of Free or Core. We give you a fixed proposal during the demo.
Premium
RecommendedFor product and security teams that want the full cycle.
- CRA and the other new frameworks
- 10 audits a month and 3 users
- 200 assets per section
- Policies, evidence, risks, tasks and the Aude assistant
Diamond
For manufacturers with many products or large teams.
- Unlimited audits and users
- Everything in Premium
Frequently asked questions
What people usually ask us about Cyber Resilience Act.
When does the Cyber Resilience Act apply?
The Regulation entered into force in December 2024. The obligations to report actively exploited vulnerabilities and severe incidents apply from 11 September 2026, and the rest, including the essential requirements and CE marking, from 11 December 2027.
I'm an importer or distributor, not a manufacturer. Does it affect me?
Yes, with different obligations. You select your role in the profile question and the questionnaire includes the importers and distributors section. If you substantially modify a product or sell it under your own brand, you may take on manufacturer obligations: there is a control to check this.
Does Audexa carry out the conformity assessment or the CE marking?
No. Audexa helps you prepare: self-assessment, action plan and evidence. The conformity assessment is done by you or by a notified body, depending on the product class, and CE marking is the manufacturer's responsibility. The Audexa result is for guidance only and is not legal advice.
What changes with the product class?
The class sets the conformity assessment route. That is why the profile asks for the class of your main product and one questionnaire section reviews the matching assessment. If you don't know the class yet, start with the product unclassified and change it later.
We already work with ISO 27001 and NIS2. Does that help?
Yes. There are 57 mappings to ISO 27001:2022 and 44 to NIS2. High-coverage answers arrive as proposals marked “Review it” and a person confirms them. They are not legal equivalences.
Which languages is it available in?
Spanish, English, French, Italian and German, like every other Audexa framework.
Request a demo
See how to prepare for the CRA in Audexa.
In 30 minutes we walk through the role and class profile, the questionnaire, the task plan and the evidence.
- We review your role and your product class.
- We show you the controls, the findings and the tasks.
- We explain which plan fits your team.