The EU Cyber Resilience Act, done step by step.
Templates, plain-language guides and a fully worked example that take a manufacturer from "Does the CRA apply to us?" to a signed EU declaration of conformity.
Three dates you cannot move
Report actively exploited vulnerabilities and severe incidents within 24 hours, for every product on the EU market (Art. 14).
Products placed on the EU market must meet Annex I, pass conformity assessment and carry the CE marking.
Handle vulnerabilities, ship security updates and keep the documentation current.
What you get
- 25 editable templates (Word and Excel), each mapped to CRA article numbers
- A 24-hour reporting playbook with ready-to-use notification templates
- 9 plain-language guides: what each file is for, why the CRA asks for it and who fills it in
- A complete worked example for a fictional smart thermostat
- Free updates until at least 31 December 2027
From scope to CE marking
- 1Scope and class
- 2Reporting playbook
- 3Programme plan
- 4Gap assessment
- 5Vulnerability handling and suppliers
- 6Risk assessment and Annex I evidence
- 7Other EU laws
- 8Technical file, declaration and CE marking
- 9After sale
See what "done" looks like
Every template has a completed counterpart for the Lumora TH-200, a fictional smart thermostat: risk register, evidence matrix, technical file, EU declaration and reporting exercise. Start with the free 4-page overview.
Scope decision: in scope, manufacturer, default class, Module A
Risk assessment: 12 risks, from firmware tampering to loss of heating in winter; every completeness check at zero
Annex I evidence matrix: 22 requirements, each with its proof
The 24 filled example files come with the full kit.
Lumora Home Technologies GmbH and Lumora TH-200 are fictional.
Written by a practitioner
Özer Koray Akdemir set up the product cybersecurity function for a new electric vehicle platform and took it through UNECE R155 type approval, among the first platforms worldwide to be approved. The kit turns that experience into documents a small team can complete.
About the author →Two ways to start
Article 14 Reporting Pack
Playbook (PDF and Word), notification templates, case file and exercise record. Updates included.
CRA Compliance Kit
All 12 modules, 25 templates, 9 guides, the worked example and the Article 14 pack. Free updates until 31 December 2027 or for 12 months, whichever is later.