A practical review for software and connected-product teams. Assign an owner, record evidence and identify the next action for every gap.
Article 14 reporting applies from 11 September 2026. Main CRA requirements apply from 11 December 2027.
Product and scope
Review item
Owner / evidence / next action
□ Define the product, versions, firmware, companion apps and necessary remote processing.
□ Document markets, economic-operator roles and applicable exclusions. Standalone SaaS is not automatically covered.
□ Review product classification and the conformity route with qualified regulatory support.
Security and development
Review item
Owner / evidence / next action
□ Maintain a product cybersecurity risk assessment and documented security decisions.
□ Review authentication, permissions, secure defaults, secrets and protection of data.
□ Integrate security review and testing into development and release approvals.
Software supply chain
Review item
Owner / evidence / next action
□ Generate a machine-readable SBOM for each release; include at least top-level dependencies.
□ Track dependency provenance, versions, support status and known vulnerabilities.
□ Assign ownership for triage, remediation and dependency updates.
Vulnerability handling and updates
Review item
Owner / evidence / next action
□ Publish a security contact and coordinated disclosure process.
□ Test intake, triage, remediation and communication with clear owners.
□ Provide secure update mechanisms and plan the product support period.
Article 14 reporting
Review item
Owner / evidence / next action
□ Establish how actively exploited vulnerabilities and severe security incidents are identified and escalated.
□ Prepare notification workflows, decision records and the applicable reporting deadlines. Reporting is not required for every vulnerability.
□ Test the reporting workflow, including out-of-hours escalation and communication to affected users.
Evidence and next steps
Review item
Owner / evidence / next action
□ Keep risk assessments, security tests, SBOMs, design decisions and remediation records linked to releases.
□ Map technical documentation gaps and manufacturer responsibilities, including conformity documentation.
□ Prioritise gaps by risk, record dependencies and agree the implementation plan.
Use this to organise an initial technical review. It is not exhaustive, legal advice, a conformity assessment or certification. Applicability and the conformity route depend on the product. Confirm formal scope with qualified counsel.