Engagement 05
CRA Readiness Check
The obligations have dates. This establishes which ones you already miss.
The situation
Most companies inside the Cyber Resilience Act have not established that they are. It reaches any manufacturer placing a product with digital elements on the EU market, which includes US companies selling through a distributor and companies whose product ships as a component inside someone else's.
Reporting obligations went live on 11 September 2026 and full application follows on 11 December 2027. The ceiling is €15 million or 2.5% of worldwide turnover, and the first obligation to bite is a 24-hour clock on actively exploited vulnerabilities.
This is you if
- You sell into the EU and have not established whether the CRA applies to your products.
- You have no documented vulnerability handling process, and the 24-hour clock is already live.
- Someone asked whether you are CRA-ready and the honest answer was that nobody had checked.
How it runs
- Week 1
Establish scope
Which products the regulation covers, under which class, and whether you are the manufacturer for each. This is the question most readiness work skips, and where most of the risk sits.
- Weeks 1–2
Position against Annex I
Your current state against the essential requirements, article by article, with evidence where it exists and a gap recorded where it does not.
- Weeks 2–3
Build the handling process
A vulnerability handling and reporting process written to the 24 and 72 hour clocks, with the named roles who execute it when the clock starts.
What you are left holding
- Scope determination: which of your products the regulation actually covers
- Your position against the essential requirements of Annex I, article by article
- A vulnerability handling and reporting process designed to the 24 and 72 hour clocks
- The gap list ordered by the date each obligation bites
What we need from you
- Your product list, with the EU distribution arrangements for each.
- Whatever vulnerability handling process exists today, including if the honest answer is that none is written down.
- Someone from legal or compliance for the scope determination, which is not an engineering question.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not legal advice. We establish your technical position against the requirements; your counsel owns the legal interpretation.
- Not a conformity assessment. We are not a notified body, and nothing here is a declaration of conformity.
The clock this is against
The dates below are in the regulation. The only computed thing is where today sits between them, so the urgency on this page cannot quietly become false.
EU Cyber Resilience Act · Regulation (EU) 2024/2847
410 days to full application
The only demand driver in this field with a date on it. One obligation is already live, and it is the one that needs an answer in hours.
Dec 2024
in effect
In force
Regulation (EU) 2024/2847 enters into force. The obligations have dates; the clock starts.
Sep 2026
in effect
Reporting live
Actively exploited vulnerabilities and severe incidents must be reported: early warning within 24 hours, full notification within 72.
A 24-hour clock you cannot meet without knowing what you ship and where it is deployed.
Dec 2027
in 410 days
Full application
Conformity assessment, CE marking and the complete essential requirements of Annex I apply to products placed on the EU market.
Up to €15 million or 2.5% of worldwide turnover for essential-requirement breaches.
What we can already show
All 41 articles of Regulation (EU) 2024/2847 are modeled in Gantry, crosswalked to the controls that evidence them.
Why people call about this one
The CRA clock is running
The regulation reaches manufacturers placing products with digital elements on the EU market, including US companies selling through a distributor. Which of your products it covers, and which obligations apply, is a determination most have not made.
Reporting obligations apply from 11 September 2026 · main obligations from 11 December 2027
The shape of it
- Shape
- Two to three weeks, fixed fee
- Usually funded by
- Compliance · Legal · CISO
- Often leads to
- Toolchain Rationalization