Luca BertonDecember 2027 is the deadline, but where are you starting from? This assessment framework helps you evaluate your CRA readiness across five critical dimensions and create a prioritized action plan.
Dimension 1: Product Inventory and Classification
- Level 0 — No complete inventory of digital products
- Level 1 — Products listed but not classified under CRA categories
- Level 2 — All products classified (Default/Important/Critical) with applicable standards identified
- Level 3 — Classification automated for new products with regulatory mapping
Dimension 2: Secure Development
- Level 0 — No formal SDLC security practices
- Level 1 — Ad-hoc security testing, no CI/CD integration
- Level 2 — SAST/DAST in CI/CD, SBOM generation, basic vulnerability scanning
- Level 3 — Full DevSecOps pipeline with CRA compliance gates, automated documentation
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Dimension 3: Vulnerability Management
- Level 0 — No formal vulnerability handling process
- Level 1 — Ad-hoc patch management, no disclosure policy
- Level 2 — Coordinated disclosure policy, SBOM-based vulnerability tracking
- Level 3 — Automated vulnerability correlation, 24-hour reporting capability, proactive monitoring
Dimension 4: Update Infrastructure
- Level 0 — Manual update distribution
- Level 1 — Basic update mechanism without signing or rollback
- Level 2 — Signed updates with automated delivery and rollback capability
- Level 3 — Staged rollouts, health monitoring, automatic security updates
Terraform for Beginners
Master Terraform to build scalable infrastructure using IaC principles.
Start on Udemy →Dimension 5: Conformity Documentation
- Level 0 — No technical documentation aligned with CRA
- Level 1 — Manual documentation, incomplete coverage
- Level 2 — Structured documentation with templates, partial automation
- Level 3 — Automated technical file generation, living documentation from CI/CD
Interpreting Your Score
Your lowest dimension is your biggest risk. A Level 3 development process with Level 0 vulnerability management means you'll build secure products but miss the September 2026 reporting deadline. Prioritize bringing every dimension to at least Level 2 before optimizing any to Level 3.
EU AI Act Compliance Checklist
40-point checklist covering risk classification, data governance, transparency, and human oversight. Based on the official regulation.
Get Free Checklist →