EU Cyber Resilience Act Workbook

The Cyber Resilience Act is a regulation with direct legal effect, administrative fines, and national enforcement that varies by Member State. This workbook structures the work and briefs your counsel — it does not replace them.

Article 14 reporting is live from 11 September 2026. Actively exploited vulnerabilities and severe incidents in products with digital elements carry reporting clocks measured in hours, to ENISA and your national CSIRT. If you sell software or connected hardware into the EU, the obligation attaches to you whether or not anyone has told you.

Why this is its own workbook. DORA covers financial entities; NIS2 covers essential and important entities by sector. Neither covers a manufacturer of a product with digital elements, which is what the CRA regulates — and the catalogue had no coverage of it at all.

What it contains: the scope test that tells you whether you are in fact a manufacturer under the regulation, the Article 14 reporting workflow with its clocks, the essential cybersecurity requirements from Annex I mapped to controls you may already have, the technical documentation set from Annex VII, the conformity assessment routes and where notified bodies are required, the vulnerability handling process the regulation obliges you to operate, and the support-period declaration.

The road to December 2027, when the full obligations apply — as a dated sequence rather than a cliff, so the work can be planned across budget cycles.

Current as of 30 August 2026. Harmonised standards and notified-body designations are still landing through 2027; the workbook says which parts of the position are settled and which are still moving, and carries a dated currency note on each.