CRA: Cyber Resilience Act for products with digital elements

Article 6 requires that products with digital elements meet the essential cybersecurity requirements in Annex I Part I only where properly installed, maintained and used as intended with necessary security updates, and that the manufacturer's own processes meet Annex I Part II.

Article 13 requires manufacturers to conduct and document a cybersecurity risk assessment, exercise due diligence on third-party and open-source components, and maintain a vulnerability-handling process including a software bill of materials for at least a 5-year support period.

Article 14 requires notifying any actively exploited vulnerability and any severe incident to the CSIRT designated as coordinator and ENISA within strict deadlines: 24-hour early warning, 72-hour notification, and a final report within 14 days (vulnerability) or one month (incident).

Article 31 requires technical documentation containing the elements set out in Annex VII, drawn up before the product is placed on the market and kept continuously updated during the support period.

Enabling CRA adds five obligations to your Obligations page. Article 6 (secure-by-default configuration) is platform-managed, evidenced by a clean CSPM scan of your cloud infrastructure, but that's a genuinely partial proxy: it covers cloud configuration only, not on-device or hardware security, or the full breadth of Annex I Part I. Article 13's software bill of materials requirement is also platform-managed, evidenced by a completed SBOM scan, again partial, since it confirms the SBOM exists but not the rest of Article 13's vulnerability-handling policy or coordinated disclosure process. The remaining obligations (the rest of Article 13, Article 14, Article 31) are tenant actions with specific, article-grounded guidance, not generic placeholders.

A CRA Technical File document type is available from the Documents section. It's generated on demand and pulls real per-company data: your software bill of materials from the Syft SBOM scan engine, and open/resolved vulnerability counts from Trivy scan findings. It's genuinely useful evidence to review and attach to your Article 31 documentation, but generating it doesn't automatically mark Article 31 complete, since the platform can't yet verify you actually reviewed and finalised it.

There's no automated check for Article 13's vulnerability-handling policy, coordinated disclosure process, or Article 14's reporting process today; all three need a real, documented process on your side.