11 September 2026
Reporting obligations
Actively exploited vulnerabilities and severe incidents must be reported within 24 hours, for every product already on the EU market (Art. 14).
The EU Cyber Resilience Act, done step by step.
Templates, plain-language guides and a fully worked example that take a manufacturer from "Does the CRA apply to us?" to a signed EU declaration of conformity.
See the kit
Get the free overviewFree PDF, 4 pages. Polar emails you the download link.
- Every template cites the article of Regulation (EU) 2024/2847 it helps you prove.
- Checked against the regulation, Commission guidance and ENISA's reporting FAQ on 1 October 2026.
- Built on first-hand experience with an earlier product cybersecurity regulation, put into practice while it was still new and taken all the way through audit and approval.
One deadline has passed. The next one is set.
The CRA applies in stages. Reporting is already mandatory, full conformity follows in December 2027, and the duties then run for as long as you support the product.
- 11 December 2027
Full conformity
Products placed on the EU market must meet Annex I, pass conformity assessment and carry the CE marking.
- From placing on the marketOngoing
Support period
Handle vulnerabilities and ship security updates, in most cases for at least five years (Art. 13(8)), and keep the technical file for at least ten years (Art. 13(13)).
What you get
- 25 editable templates (Word and Excel), each mapped to CRA article numbers
- A 24-hour reporting playbook with ready-to-use notification templates
- 9 plain-language guides: what each file is for, why the CRA asks for it and who fills it in
- A complete worked example for a fictional smart thermostat
- Free updates until at least 31 December 2027
Your compliance files stay with you
The kit is files, not a platform. You work in Word and Excel on your own systems, and nothing about your products leaves your company.
Nothing to upload
No account, and no upload of source code, SBOMs, unpatched vulnerabilities or incident details. The most sensitive information a manufacturer holds stays on its own systems.
No new vendor to approve
There is no cloud service for your security team or procurement to assess first. Download today, start tomorrow.
Readable in ten years
The CRA asks you to keep the technical documentation for at least ten years (Art. 13(13)). Word, Excel and PDF files remain readable long after any subscription has ended.
Pay once
One price. No subscription and no fees per product or per user. Updates until at least the end of 2027 are included.
What the kit does not do: it does not scan your code or monitor vulnerabilities. Keep the tools you already use for that; the kit shows which evidence the CRA expects from them.
Compare the options:Consultant, platform or template kit: which one still works for you in five years?
From scope to CE marking
- 1Scope and class
- 2Reporting playbook
- 3Programme plan
- 4Gap assessment
- 5Vulnerability handling and suppliers
- 6Risk assessment and Annex I evidence
- 7Other EU laws
- 8Technical file, declaration and CE marking
- 9After sale
See what "done" looks like
Every template has a completed counterpart for the Lumora TH-200, a fictional smart thermostat: risk register, evidence matrix, technical file, EU declaration and reporting exercise. Start with the free 4-page overview.
Scope decision: in scope, manufacturer, default class, Module A
Risk assessment: 12 risks, from firmware tampering to loss of heating in winter; every completeness check at zero
Annex I evidence matrix: 22 requirements, each with its proof
Get the free overviewFree PDF, 4 pages. Polar emails you the download link.
The 24 filled example files come with the full kit.
Lumora Home Technologies GmbH and Lumora TH-200 are fictional.
Written by a practitioner
Özer Koray Akdemir is a product cybersecurity architect. He built a product cybersecurity function under a regulation that was still new and took it through audit and type approval. The kit turns that experience into documents a small team can complete.
About the author →