# Blog Canonical: https://craguard.eu/blog Language: en Last updated: 2026-09-02 Blog 6 Sep 2026 ## [The CRA timeline 2024–2027: what to do each quarter](https://craguard.eu/blog/cra-timeline-2024-2027) The Cyber Resilience Act feels like a flood of obligations, but laid out on a timeline it's a manageable plan. Regulation (EU) 2024/2847 has three key dates and a clear order of steps. This article is 5 Sep 2026 ## [Custom software and agencies: who is the manufacturer when you build for a client?](https://craguard.eu/blog/custom-software-who-is-the-manufacturer) "We built an app for a client — who is the manufacturer under the CRA now?" This question troubles every agency and freelancer. The answer has a clear core and grey edges. Let's work through both, so 4 Sep 2026 ## [Supplier security questionnaires: what large customers will ask for and how to prove it](https://craguard.eu/blog/supplier-security-questionnaires) The first to ask you about the CRA won't be a surveillance authority — it'll be your customer. Large firms and public procurers push security requirements down to suppliers through questionnaires and 3 Sep 2026 ## [SBOM for small vendors: what the CRA actually requires (and what it doesn't)](https://craguard.eu/blog/sbom-for-small-vendors-what-the-cra-requires) When people say "comply with the Cyber Resilience Act", most small software companies picture mountains of paperwork. In fact one of the first and most useful things is very concrete and takes minutes 2 Sep 2026 ## [CRA reporting starts 11 September 2026: what a small software vendor should do this week](https://craguard.eu/blog/cra-reporting-11-september-2026) The Cyber Resilience Act (Regulation (EU) 2024/2847) has two dates, and most small software companies remember only half of each. The second one — 11 December 2027, full conformity and CE marking — is 1 Sep 2026 ## [CRA vs NIS2 vs GDPR: which one applies to you](https://craguard.eu/blog/cra-vs-nis2-vs-gdpr-en) "We already have GDPR, so we don't need the CRA" — this sentence comes up often, and it's wrong. The CRA, NIS2 and GDPR are three different laws, each aimed at something else, and they can easily appl 31 Aug 2026 ## [Importers and distributors: your duties when you resell non-EU software or devices](https://craguard.eu/blog/importers-and-distributors-duties) Many companies make nothing — they just resell or import someone else's software and devices. It's easy to assume "the CRA doesn't concern us". It's not so: importers and distributors have their own d 30 Aug 2026 ## [Open source and the CRA: the libraries you use, and what an open-source steward is](https://craguard.eu/blog/open-source-and-the-cra-steward) Open source and the Cyber Resilience Act is a topic where relief and surprise mix. The relief: the regulation doesn't turn every open-source developer into a manufacturer. The surprise: when you use o 29 Aug 2026 ## [Harmonised standards are late: what to do until they are in the Official Journal](https://craguard.eu/blog/harmonised-standards-are-late) There's confusion around the CRA's harmonised standards — and it helps to know why. In short: the standards meant to make your life easier aren't out yet. Let's explain what that means for a small com 28 Aug 2026 ## [The Declaration of Conformity and CE marking for downloadable software](https://craguard.eu/blog/declaration-of-conformity-ce-marking-software) "A CE mark on software you just download from a website?" Yes — and the Cyber Resilience Act says exactly how. Before placing a product on the market, the manufacturer draws up an EU declaration of co 27 Aug 2026 ## [A two-page cybersecurity risk assessment under Article 13](https://craguard.eu/blog/two-page-risk-assessment-article-13) The phrase "risk assessment" sounds like a weeks-long project, but for a small company it's a two-page document you write once and then just maintain. The Cyber Resilience Act requires it in Article 1 26 Aug 2026 ## [Self-assessment under Module A: what your technical documentation must contain](https://craguard.eu/blog/self-assessment-module-a-technical-documentation) If you're in the default class (which is most vendors — more in the classes article), you declare CRA conformity yourself. It's called Module A (internal production control): no notified body, but ful 25 Aug 2026 ## [CRA product classes: default, important I/II, critical — with examples](https://craguard.eu/blog/cra-product-classes-explained) Not every product with digital elements is assessed with the same rigour. The Cyber Resilience Act sorts them into four levels by risk, and yours determines whether you assess conformity yourself or n 24 Aug 2026 ## [Article 14 step by step: 24 h, 72 h, 14 days — how reporting through the ENISA platform works](https://craguard.eu/blog/article-14-step-by-step-enisa-platform) The reporting duty under Article 14 is the first thing from the Cyber Resilience Act that applies for real — from 11 September 2026, and it applies even to products you placed on the market long ago. 23 Aug 2026 ## [Security advisories: when and how to publish a fixed vulnerability](https://craguard.eu/blog/security-advisories-when-and-how) The last step of the vulnerability-handling process is the most visible one: an advisory — a public notice that you have fixed a security problem. The Cyber Resilience Act requires it in Annex I, Part 22 Aug 2026 ## [A coordinated vulnerability disclosure policy: what it must contain (with a template)](https://craguard.eu/blog/coordinated-vulnerability-disclosure-policy-template) Once you have a reporting channel and security.txt, one thing is still missing: a policy that says what happens to a report. The Cyber Resilience Act requires it in Annex I, Part II as a coordinated v 21 Aug 2026 ## [security.txt and a vulnerability disclosure channel: the Annex I duty you can meet in an hour](https://craguard.eu/blog/security-txt-and-vulnerability-channel) Among the Cyber Resilience Act's obligations there is one that costs an hour of work and is done once and for all: a channel through which people can report a vulnerability to you. It is required by A 20 Aug 2026 ## [The CRA support period: how long you must ship security updates](https://craguard.eu/blog/the-cra-support-period) "How long do we actually have to support this?" is the question that, under the Cyber Resilience Act, sets your costs for years ahead. The answer is in Article 13 of Regulation (EU) 2024/2847, and it 19 Aug 2026 ## [CVE, CVSS, EPSS, KEV explained for small vendors](https://craguard.eu/blog/cve-cvss-epss-kev-explained) When a new vulnerability appears, a small company doesn't need an academic lecture — it needs to know what to do and by when. Four acronyms serve that purpose. Each answers a different question, and t 18 Aug 2026 ## [How to generate an SBOM from package-lock.json or NuGet in 10 minutes](https://craguard.eu/blog/how-to-generate-an-sbom-in-10-minutes) An SBOM sounds like a big compliance task, but in practice it is one command and a few minutes. The Cyber Resilience Act requires it in Annex I, Part II, point 1 as part of the vulnerability-handling 17 Aug 2026 ## [The CRA and SaaS: when you are out of scope — and when you are not](https://craguard.eu/blog/cra-and-saas-in-or-out-of-scope) Of all the scope questions, SaaS and the Cyber Resilience Act generate the most confusion. The short answer: a pure cloud service is mostly outside the scope of Regulation (EU) 2024/2847. The longer a 16 Aug 2026 ## [Does the CRA apply to you? 10 real-world examples from the Commission guidance](https://craguard.eu/blog/does-the-cra-apply-to-you-10-examples) For a small company, "does the CRA apply to us?" is the first and most important question — until you answer it, there is no point worrying about documentation or reporting. Regulation (EU) 2024/2847 --- Source: CRAguard — https://craguard.eu