SIGQ has published a white paper, A Guide to Complying with the EU Cyber Resilience Act (CRA), covering how to respond to the Cyber Resilience Act ("CRA"), which imposes new obligations on manufacturers selling digital products in the EU market.
Going beyond an explanation of the CRA's regulatory structure, the white paper follows the practical workflow step by step: how to determine whether your products are in scope, what documentation and assessments each product category requires, and how to build a post-market process for handling vulnerabilities and severe incidents.
White paper overview
- Title: A Guide to Complying with the EU Cyber Resilience Act (CRA): From Understanding the Regulation to Practical Preparation
- Download URL: https://incidentlake.com/cra-202608
Background and purpose: a guide to the big picture, with reporting obligations just around the corner
The CRA requires manufacturers selling "products with digital elements," whether hardware or software, in the EU market not only to place products on the market in a secure state, but also to maintain processes for continuously discovering, fixing, and reporting vulnerabilities after sale. Obligations to report actively exploited vulnerabilities and severe incidents to EU authorities begin on September 11, 2026, and the main obligations apply in full from December 11, 2027.
Meanwhile, many manufacturers in Japan say they "can't tell whether our products are in scope" or "don't know what to prepare, or by when." The CRA consists of the main text (articles) and eight legally binding annexes, and the required conformity assessment procedures differ by product category, so simply grasping the big picture is the first hurdle.
To help manufacturers that sell products in the EU take the first step, SIGQ has published this white paper, which brings together everything from understanding the regulation to practical preparation in a single document.
Key contents of the white paper
- The CRA's purpose and scope, and the structure of the regulation, consisting of the main text and annexes
- The two areas manufacturers must address: conformity before placing products on the market (A) and post-market vulnerability and incident handling (B)
- How to determine whether your products fall under the CRA and whether they qualify as Important or Critical products under Annex III/IV
- The outputs required for each product category (technical documentation, EU declaration of conformity, CE marking, third-party assessment, etc.)
- The seven post-market obligations, plus the criteria and deadlines for reporting to the EU (24 hours / 72 hours / final report)
- A proposed compliance timeline for 2026-2027 and an approach to dividing roles internally and externally
Read the white paper
The white paper is available for download from Understanding and Complying with the EU Cyber Resilience Act (White Paper). We hope you find it useful!
Inquiries
Please contact us via SIGQ Inc.'s contact form.