CYBER RESILIENCE ACT · PRACTICAL PLANNING TOOL

Get your software security work in order.

A plain-language checklist for teams that make or supply software products in the EU. Save progress in this browser, see official sources, and export your working notes.

This is a preparation aid, not a legal scope assessment or compliance certificate. CRA scope depends on the product, how it is supplied, your role and the facts around it. “Unsure” is a valid result—get the scope reviewed.

First, describe your situation

These answers organize your review. They do not decide whether the Act applies.

Is the product made available in the EU?What is your organisation’s role?What are you supplying?

Your current signal: Key scope facts are still unknown. Record them and ask a qualified adviser to review the product and your role.

YOUR WORKING PLAN

Review the areas that need an owner

01Map the product and EU marketList product versions, intended purpose, digital elements, EU sales channels and economic operator roles. Get a qualified scope review.02Record a cybersecurity risk assessmentDocument the product threat model, foreseeable use, security controls and residual risks; keep it current across the support period.03Maintain a software component inventoryCreate and maintain an SBOM in a commonly used, machine-readable format; at minimum, identify top-level dependencies and confirm what else your product needs to track.04Set up vulnerability handlingPublish a security contact, receive reports, triage vulnerabilities, prepare fixes and coordinate disclosure.05Define a support periodSet a support period that reflects expected use and applicable rules; publish the period and security-update availability.06Plan secure delivery and update verificationProtect update channels, authenticate updates, test security fixes and provide them without delay when required.07Prepare technical documentation and conformity stepsIdentify the applicable product category, conformity assessment route, technical file and EU declaration requirements.08Prepare the CRA reporting workflowAssign owners and escalation paths for actively exploited vulnerabilities and severe incidents, including ENISA Single Reporting Platform access.

Reviewed 0 of 8 planning areas. Progress is saved only in this browser; it is not sent to EUAiShield.

AI ACT · ARTICLE 50Review your product website for AI transparency signals →This is a separate website review. It does not assess CRA product cybersecurity.DATED WEBSITE EVIDENCEKeep website scan history and set up page-change monitoring →CRA checklist data stays in this browser; the workspace monitors web-page observations separately.

INCIDENT DEADLINE HELPER

Start the clock from when you became aware

For qualifying actively exploited vulnerabilities and severe incidents, CRA reporting phases begin from awareness. Select this only after confirming that the event meets a reporting trigger. This helper does not file a report or calculate every final-report deadline.

I have confirmed this may be a CRA-reportable event and want a planning reminder.

Official sources to check

Tool content reviewed 1 October 2026. Legal text and implementation guidance can change; check the linked official sources before acting.