---
name: "CRA Conformity Self-Assessment"
version: "1.0"
updated: "2026-07-20"
source: "https://www.orbiqhq.com/templates/cra-conformity-self-assessment"
license: "Free to use and adapt within your organisation. Attribution appreciated. Not legal advice."
legal_basis:
  - "https://eur-lex.europa.eu/eli/reg/2024/2847/oj"            # Cyber Resilience Act — Art. 13, 14, 32, Annex I, III, IV, VII, VIII
  - "https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj"       # CIR (EU) 2025/2392 — technical descriptions of important/critical product categories
---

# CRA Conformity Self-Assessment (machine-readable)

Purpose: run a Cyber Resilience Act readiness assessment for a product with digital elements —
scope, classification (default / important Class I / important Class II / critical), the lawful
Article 32 conformity route, requirement-by-requirement Annex I checks, and documentation and
Article 14 reporting readiness. This file is self-contained: an agent can classify a product,
derive the lawful conformity routes, generate the two Annex I checklists with status tracking,
and produce a gap report from the definitions below.

The CRA clock (Regulation (EU) 2024/2847):
- `2024-12-10` — in force.
- `2026-06-11` — Chapter IV applies (notified bodies can be designated).
- `2026-09-11` — Article 14 reporting duties apply, including for products already on the market
  (single reporting platform; 24h / 72h / 14d for actively exploited vulnerabilities,
  24h / 72h / 1 month for severe incidents).
- `2027-12-11` — full application: Annex I essential requirements, Annex VII technical
  documentation, EU declaration of conformity, CE marking.

Structural rules:
1. Classification precedes everything: the lawful conformity routes are a FUNCTION of
   (classification, harmonised_standards_fully_applied, is_foss). Never pick a module first.
2. Classification follows CORE functionality (CIR (EU) 2025/2392, adopted 2025-11-28): a product
   integrating a component from an Annex III/IV category is NOT classified by that component
   unless the category matches the product as a whole. Record the reasoning.
3. Every `not_applicable` status on an Annex I Part I point (2) requirement MUST cite the
   Article 13(2) cybersecurity risk assessment as justification — point (2) applies
   "where applicable" on the basis of that assessment, not on convenience.
4. Penalties (Art. 64): Annex I / Art. 13 / Art. 14 breaches up to EUR 15,000,000 or 2.5% of
   total worldwide annual turnover, whichever is higher.

Jurisdiction notes: UK — no CRA equivalent; the PSTI regime (in force 2024-04-29) covers
consumer connectable products with a narrower baseline. Norway/EEA — the CRA is EEA-relevant and
expected to be incorporated into the EEA Agreement; products placed on the EU market are in scope
regardless of manufacturer location.

---

## 1. Scope test — all three must hold, none of the exclusions

| # | Field | Type | Rule |
|---|---|---|---|
| 1 | `is_product_with_digital_elements` | bool | Software or hardware product and its remote data processing solutions, with an intended or reasonably foreseeable direct or indirect data connection (Art. 3(1)) |
| 2 | `placed_on_eu_market` | bool | Made available in the course of a commercial activity — free products monetised otherwise count |
| 3 | `sectoral_exclusion` | enum | `none` / `medical_devices_mdr_ivdr` / `civil_aviation` / `motor_vehicles` / `marine_equipment` / `national_security_defence` — any non-`none` value exits CRA scope |
| 4 | `saas_note` | info | Pure SaaS is out of scope unless it is a remote data processing solution of a product with digital elements |

## 2. Classification

| Field | Type | Rule |
|---|---|---|
| `class1_categories` | fixed list (19) | identity_mgmt_and_pam, browsers, password_managers, malware_detection, vpn_products, network_management, siem, boot_managers, pki_certificate_issuance, network_interfaces, operating_systems, routers_modems_switches, microprocessors_security_functions, microcontrollers_security_functions, asics_fpgas_security_functions, smart_home_virtual_assistants, smart_home_security_devices, internet_connected_toys, personal_wearables_health |
| `class2_categories` | fixed list (4) | hypervisors_container_runtimes, firewalls_ids_ips, tamper_resistant_microprocessors, tamper_resistant_microcontrollers |
| `critical_categories` | fixed list (3) | hardware_security_boxes (HSMs, payment terminals), smart_meter_gateways, smartcards_secure_elements |
| `core_functionality_match` | text | The matched category IF the product AS A WHOLE matches its CIR (EU) 2025/2392 technical description; integrated/ancillary components do not classify the product |
| `classification` | enum | `default` / `important_class_1` / `important_class_2` / `critical` — `default` when no core-functionality match |

## 3. Conformity route derivation (Art. 32)

```
inputs: classification, standards_fully_applied (bool), is_foss (bool)

default            -> [module_a, module_b_c, module_h, eucc]           # manufacturer's choice
important_class_1  -> standards_fully_applied or is_foss(public docs)
                      ? [module_a, module_b_c, module_h, eucc_substantial]
                      : [module_b_c, module_h, eucc_substantial]
important_class_2  -> is_foss(public docs)
                      ? [module_a, module_b_c, module_h, eucc_substantial]
                      : [module_b_c, module_h, eucc_substantial]
critical           -> eucc scheme where mandated by delegated act, else class-2 routes

notified_body_required = chosen_route in [module_b_c, module_h]
```

Caveat mid-2026: CRA harmonised standards are still in development (standardisation request
M/606, 41 standards, accepted by CEN/CENELEC/ETSI 2025-04-03; horizontal drafts prEN 40000-1-2 /
-1-3 / -1-4). `standards_fully_applied = true` requires citations in the OJEU — verify before
relying on the Class I self-assessment route.

## 4. Annex I Part I checklist — 14 records

Fields per record: `ref`, `requirement`, `status` (enum: `compliant` / `partial` / `gap` /
`not_applicable`), `evidence`, `owner`, `notes` (justification REQUIRED when `not_applicable`).

| ref | requirement (summary) |
|---|---|
| 1 | Appropriate level of cybersecurity based on the risks (anchored in the Art. 13(2)/(3) risk assessment) |
| 2a | No known exploitable vulnerabilities at the time of placing on the market |
| 2b | Secure by default configuration, with reset-to-original-state |
| 2c | Vulnerabilities addressable via security updates; automatic security updates with user opt-out as default, where applicable |
| 2d | Protection from unauthorised access (authentication, identity/access management); report possible unauthorised access |
| 2e | Confidentiality of stored/transmitted/processed data (state-of-the-art encryption at rest and in transit) |
| 2f | Integrity of data, commands, programs, configuration against unauthorised manipulation; report corruptions |
| 2g | Data minimisation — only adequate, relevant, necessary data processed |
| 2h | Availability of essential and basic functions, incl. DoS resilience and mitigation |
| 2i | Minimise negative impact on availability of other devices' or networks' services |
| 2j | Limit attack surfaces, including external interfaces |
| 2k | Reduce incident impact via exploitation mitigation mechanisms |
| 2l | Security-related information by recording/monitoring internal activity, with user opt-out |
| 2m | Secure, easy, permanent removal of all data and settings; secure transfer to another product where applicable |

## 5. Annex I Part II checklist — 8 records

Same fields as Part I. `not_applicable` is rarely defensible in Part II (process duties).

| ref | requirement (summary) |
|---|---|
| 1 | Identify and document vulnerabilities and components; SBOM in a commonly used machine-readable format, covering at least top-level dependencies |
| 2 | Address and remediate vulnerabilities without delay; security updates separate from functionality updates where technically feasible |
| 3 | Effective and regular security tests and reviews |
| 4 | Public disclosure of fixed vulnerabilities once the update is available (description, impacts, severity, remediation info) |
| 5 | Coordinated vulnerability disclosure (CVD) policy in place and enforced |
| 6 | Facilitate vulnerability information sharing; provide a contact address for reporting |
| 7 | Secure distribution mechanisms for updates |
| 8 | Security patches disseminated without delay and free of charge, with advisory messages |

## 6. Docs & reporting readiness

| # | item | rule |
|---|---|---|
| 1 | `technical_documentation` | Annex VII: product description, design/development/vulnerability-handling info, risk assessment, support-period determination, applied standards, test reports, EU DoC (Annex V). Keep ≥10 years or the support period, whichever is longer |
| 2 | `support_period` | Art. 13(8): reflects expected use time, MINIMUM 5 years unless shorter expected use; end date stated at purchase |
| 3 | `srp_access` | ENISA Single Reporting Platform registration + internal owner before 2026-09-11 |
| 4 | `art14_process_vulns` | 24h early warning / 72h notification / 14d final report for actively exploited vulnerabilities |
| 5 | `art14_process_incidents` | 24h / 72h / 1 month for severe incidents |
| 6 | `user_information` | Art. 14(8): inform impacted users, where appropriate in structured machine-readable format — see cra-vulnerability-advisory-template.md |
| 7 | `ce_marking` | Affixed per Art. 30 after the conformity route completes; mandatory for placing on the market from 2027-12-11 |

## Agent workflow hints

- GAP REPORT: list records with `status` in {`gap`, `partial`} ordered by (Part I before Part II,
  then ref); attach `evidence` expectations from the requirement text.
- ROUTE CHECK: recompute section 3 whenever `classification`, `standards_fully_applied`, or
  `is_foss` changes; flag if the chosen route is no longer lawful.
- N/A AUDIT: every `not_applicable` in Part I without a risk-assessment citation in `notes` is a
  finding, not a pass.
- TIMELINE ALERTS: warn when target market-entry ≥ 2027-12-11 and any `gap` remains; warn when
  `srp_access` unset after 2026-09-11.