CRA Compliance Checklist: 45-Point Guide for Software Manufacturers [2026]

Determine Your Obligations

1. Product inventory completed — all products with digital elements catalogued
2. Each product classified: default, Important Class I, Important Class II, or Critical
3. Conformity assessment path identified per product category (self-assessment for default, third-party for Important/Critical)
4. Support period defined for each product (minimum 5 years or expected product lifetime)
5. Exemptions assessed — do any products fall under MDR, aviation, or automotive sector-specific regulations?

Phase 1 Score: ___ / 10

6. Secure development lifecycle (SDLC) documented and followed
7. Threat modelling performed for each product
8. Static analysis (SAST) integrated into CI/CD pipeline
9. Dynamic analysis (DAST) performed regularly
10. Dependency scanning for known vulnerabilities (all third-party components)
11. Security testing performed before each release (including regression tests for previous vulnerabilities)
12. Code review process includes security review for critical components
13. Build environment secured — reproducible builds, access-controlled CI/CD

Phase 2 Score: ___ / 16

14. Products delivered with secure-by-default configuration (no known exploitable vulnerabilities)
15. Authentication mechanisms protect against unauthorised access
16. Data at rest and in transit is encrypted using state-of-the-art cryptography
17. Attack surface minimised — only necessary ports, protocols, and services enabled
18. Confidentiality, integrity, and availability of data protected
19. Products designed to limit exploitation impact (least privilege, segmentation)
20. Logging of security-relevant events enabled
21. Security updates can be delivered reliably, automatically where appropriate

Phase 3 Score: ___ / 16

⚠️ These requirements apply from 11 September 2026

22. Coordinated vulnerability disclosure (CVD) process established and publicly documented
23. Contact point for vulnerability reports accessible and responsive
24. Actively exploited vulnerabilities reported to ENISA within 24 hours of awareness
25. Severe vulnerabilities (not yet exploited) reported within 72 hours
26. Vulnerability remediation process with defined SLAs (critical: days, high: weeks)
27. Security advisory publication process — users notified of vulnerabilities and patches
28. Component inventory maintained for vulnerability correlation (which products use which components)

Phase 4 Score: ___ / 14

29. SBOM generated for each product release (CycloneDX or SPDX format)
30. SBOM includes at minimum all top-level dependencies
31. SBOM delivery mechanism defined (machine-readable, available to customers and authorities)
32. Technical documentation prepared per Annex VII (design, development, assessment, vulnerability handling)
33. User information provided — secure configuration instructions, support contact, update procedures
34. Open-source component licence compliance verified
35. Third-party component risk assessment documented

Phase 5 Score: ___ / 14

36. Conformity assessment completed (self for default, third-party for Important/Critical)
37. EU declaration of conformity drawn up
38. CE marking affixed to product or packaging
39. Technical documentation retained for 10 years after product placed on market
40. Market surveillance authority notification process established
41. Post-market monitoring system operational — tracking vulnerability reports, user feedback, and component updates
42. Recall/withdrawal procedure documented for products with non-compliant vulnerabilities
43. Supply chain notification — inform distributors and importers of known vulnerabilities
44. Designated EU representative appointed (if manufacturer is outside the EU)
45. Internal compliance review schedule established (annual minimum)

Phase 6 Score: ___ / 20

• 75-90: Strong compliance posture. Proceed to formal conformity assessment.
• 55-74: Good foundation. Focus on Phase 4 (vulnerability handling) — September 2026 deadline is imminent.
• 35-54: Significant gaps. Prioritise Phases 2-4 (secure development and vulnerability handling).
• 15-34: Early stage. Start with Phase 1 (classification) and Phase 4 (vulnerability handling for September 2026).
• 0-14: Pre-compliance. Immediate mobilisation required. Engage legal and engineering leadership.