The EU Cyber Resilience Act, done step by step.
Templates, plain-language guides and a fully worked example that take a manufacturer from "does the CRA apply to us?" to a signed EU declaration of conformity.
Three dates you cannot move
report actively exploited vulnerabilities and severe incidents within 24 hours, for every product on the EU market (Art. 14).
products placed on the EU market must meet Annex I, pass conformity assessment and carry the CE marking.
handle vulnerabilities, ship security updates, keep the documentation.
What you get
- 25 editable templates (Word and Excel), mapped to CRA article numbers
- A 24-hour reporting playbook with ready notification templates
- 9 plain-language guides: what each file is, why the CRA asks for it, who fills it in
- A complete worked example for a fictional smart thermostat
- Free updates until at least 31 December 2027
From scope to CE marking
- 1Scope and class
- 2Reporting playbook
- 3Programme plan
- 4Gap assessment
- 5Vulnerability handling and suppliers
- 6Risk assessment and Annex I evidence
- 7Other EU laws
- 8Technical file, DoC and CE
- 9After sale
See what "done" looks like
Every template has a filled counterpart for Lumora TH-200, a fictional smart thermostat: risk register, evidence matrix, technical file, EU declaration, reporting exercise. Read the 4-page example guide for free.
Scope decision: in scope, manufacturer, default class, Module A
Risk assessment: 12 risks, from firmware tampering to loss of heating in winter; every completeness check at zero
Annex I evidence matrix: 22 requirements, each with its proof
Lumora Home Technologies GmbH and Lumora TH-200 are fictional.
Written by a practitioner
Özer Koray Akdemir has spent more than 25 years building systems that have to be secure, from cryptography to connected vehicles. He built a product cybersecurity function from scratch and led a new vehicle platform to UNECE R155 type approval, one of the first in the world. Its management system received the longest approval validity available.
About the author →Two ways to start
Article 14 Reporting Pack
Playbook (PDF + Word), notification templates, case file and exercise record. Updates included.
CRA Compliance Kit
All 12 modules, 25 templates, 9 guides, the worked example and the Article 14 pack. Free updates until 31 Dec 2027 or 12 months, whichever is later.