Product cybersecurity
EU Cyber Resilience Act (CRA) Compliance
From the first gap assessment to the conformity assessment, for every product with digital elements you sell in the EU.
Best forManufacturers and importers of connected products sold in the EU. Reporting duties from 11 September 2026, the full regulation from 11 December 2027.
Service overview
Four steps from where you are to a product file that holds up
The CRA applies to almost every product with digital elements placed on the EU market: controllers, gateways, sensors, drives, HMIs, the software that runs them and the software that talks to them. It asks for two things: a product built to the essential requirements in Annex I, and a manufacturer who handles vulnerabilities for the whole support period.
We take you through it in four steps. First we find the gaps, then we prepare the documents, then we tell you what to change in the product and how, and finally we take you through the conformity assessment. You can stop after any step and continue on your own.
Products under the Radio Equipment Directive delegated act (Articles 3.3 d, e and f, applicable since August 2025) are handled on the same track. The same evidence serves both, and the CRA is meant to replace the delegated act once it applies in full.
What the four steps cover
- Gap assessment: scope, product class and every Annex I essential requirement, reported as a Traffic Light
- Documentation: cybersecurity risk assessment, technical documentation, SBOM, user information, EU declaration of conformity
- Vulnerability handling: coordinated disclosure, security updates for the support period, readiness for the 24-hour early warning
- Product changes: what to change to meet the requirements, in priority order, with the least change to the design
- Conformity assessment: self-assessment where allowed, notified body where required, CE marking and the declaration
- RED DA Articles 3.3 d, e and f on the same evidence
- Overlap with IEC 62443-4-1 and IEC 62443-4-2 used, so nothing is documented twice
Product class and conformity route
Which route applies to you
The CRA sorts products into four classes. The class decides who assesses conformity, and that decides most of the effort. We settle it in the first week.
Most controllers, drives, sensors, HMIs, gateways and the software that comes with them. Industrial automation and control systems are not on the important or critical lists.
Self-assessment (internal control, Module A): check the product against Annex I, write the technical file, sign the EU declaration of conformity, apply the CE mark.
Switches, routers and modems, operating systems, VPN products, identity and access management, network management systems, SIEM, boot managers, microcontrollers and microprocessors with security functions.
Self-assessment only if harmonised standards, common specifications or a European cybersecurity certification scheme are applied in full. Otherwise a notified body: EU-type examination plus conformity to type (Modules B and C) or full quality assurance (Module H).
Firewalls, intrusion detection and prevention systems, hypervisors and container runtimes, tamper-resistant microcontrollers and microprocessors.
Third-party assessment, always: Modules B and C, Module H, or a European cybersecurity certification scheme.
Hardware devices with security boxes, smart meter gateways and other devices for advanced security purposes, smartcards and secure elements.
A European cybersecurity certification scheme where the Commission requires one; until then, as Class II.
Gap assessment output
The traffic light report
The gap assessment reports every essential requirement in one of three colours, so you know what to leave alone, what to write down and what to build first.
Green
Keep doing
The requirement is met. We note the evidence and where it goes in the technical file.
Amber
Tune up
Met in practice but not documented, or only partly met. Usually a document, a setting or a process to write down.
Red
Start now
Not met. A product change or a new process, planned first because it sets the timeline to the conformity assessment.
Our approach
Engagement methodology
The steps of the engagement, built around how your team already designs, builds and releases the product.
Gap assessment
Fix the scope: which products, which class, which conformity route, who is the manufacturer under the regulation. Then check the product and how you support it against every essential requirement in Annex I, Part I for the product and Part II for vulnerability handling. The output is a Traffic Light report and a priority list.
Documentation preparation
We write the product file with you: the cybersecurity risk assessment, the technical documentation in Annex VII, the SBOM, the information and instructions for the user, the vulnerability disclosure policy, the reporting procedure and the EU declaration of conformity. Where you already hold IEC 62443-4-1 or IEC 62443-4-2 evidence, we reuse it instead of writing it twice.
Product changes and security suggestions
For every red and amber finding we say what to change in the product and how to build it with the least change to the design: secure defaults, the update mechanism, access control, logging, the attack surface you can remove. Your engineers keep the decisions; we give them the options and the reasons.
Conformity assessment
For default products we take you through the self-assessment and the declaration. For important and critical products we prepare the file for the notified body, answer their questions with you and close the findings. The CE mark goes on when the file will hold up, not before.
Common questions
Frequently asked questions
Talk to RelyBlue
Ready to discuss EU Cyber Resilience Act (CRA) Compliance?
An honest conversation about your product and the path to CRA compliance or IEC 62443 certification. No sales pressure, no fear tactics.
- You talk to a senior advisor, never a salesperson