ARCHbartosz@archengineering.dev:~/cra

cat ./cra/README.md

Cyber Resilience Act for connected devices

Practical tools and plain answers for small teams that make connected hardware. Built on the regulation, the Commission guidance of July 2026 and ENISA's own documentation, not on the articles that contradict each other.

./readiness --check ↵./reporting_clock

git log --oneline ./regulation

you are here · 20 Oct 2026
  1. 10 Dec 2024Enters into force.
  2. 11 Sep 202624-hour reporting applies to every product on the EU market, old ones included.
  3. 11 Dec 2027Design requirements, documentation and CE marking for new products.

# 39 days of reporting duty · 417 days until 11 Dec 2027

cat ./cra/clock.txt

The clock, once you are aware

  1. T+0AwareReasonable certainty after a prompt initial assessment.
  2. T+24 hEarly warningWhat happened and which EU countries the product is sold in.
  3. T+72 hNotificationInitial assessment, severity and what users can do now.
  4. fix + 14 d · or 72 h + 1 monthFinal report14 days after a fix for exploited vulnerabilities, one month after the notification for severe incidents.

All three go through ENISA's Single Reporting Platform. It has no API, so every report is typed in by a person with an EU Login account.

ls -la ./cra/

Free tools

-rwxr-xr-x readinessReadiness checklistEverything the CRA asks of a device maker as one checklist, sorted by deadline, with a gap report to take to your team.-rwxr-xr-x sbom_watchSBOM exploit watchDrop a firmware SBOM and see which components have vulnerabilities exploited in the wild, rechecked every time you come back.-rwxr-xr-x reporting_clockReporting clockDeadlines for all three reports, a calendar file and the ENISA form fields required at each stage.-rwxr-xr-x scope_checkAm I in scope today?Seven questions about one product: what applies now, what changes in 2027 and whether your backend counts.-rw-r--r-- security.txtsecurity.txt generatorA standard contact file plus a coordinated vulnerability disclosure policy, which the CRA expects.

# runs in your browser · nothing you enter leaves it

grep -i "myth" ./cra/notes.md

What the articles get wrong

"It starts in December 2027."

Reporting started on 11 September 2026, for every product on the market, including ones sold years ago and ones past their support period.

"Every CVE must be reported."

Only vulnerabilities actively exploited in your product. A flaw in unreachable library code still needs fixing, but not reporting.

"Five years of support."

Five years is the minimum. A meter that stays on a wall for fifteen years needs fifteen years of support.

"The cloud side is out of scope."

A backend you develop, without which the device cannot do its job, is part of the product, reporting included.

cat ./blog/the-cra-clock-is-already-running.md →

./start_project.sh --scope=cra

Own the 24-hour clock without a compliance team

SBOMs per firmware release, daily vulnerability checks against your fleet, and a reporting procedure your team can run at two in the morning.

Get in touch ↵

Engineering guidance, not legal advice. Check the regulation and official guidance for your specific case.