roja.Get a free Snapshot
A working document / 40 checks

CRA compliance checklist.

A practical first review, from the product boundary to the incident process. Use it to identify owners and evidence; a completed list is not proof of conformity.

How to use the checklist

Review one actual product release with the product owner and engineering lead. Mark each item as evidenced, incomplete, not applicable with a rationale, or needing qualified review. Keep the artifact reference, owner and due date next to each decision. Revisit the list when the product or supported release changes.

  1. Define the product and intended purpose
  2. Identify the manufacturer and EU economic-operator roles
  3. Map EU sales channels and markets
  4. Record hardware, firmware, app and necessary remote processing boundaries
  5. Document the likely class against Annex III and Annex IV
  6. Select and review the conformity route
  7. Check external lab or notified-body scope
  8. Assign a product-security owner and substitute
  9. Inventory all supported releases
  10. Generate a machine-readable SBOM from the build
  11. Validate component names and versions
  12. Record vendored and backported components
  13. Connect SBOMs to immutable release identifiers
  14. Match public vulnerability information
  15. Check CISA KEV and ENISA EUVD information
  16. Triage product applicability with engineering
  17. Document VEX decisions and rationale
  18. Track remediation and verification
  19. Assess secure defaults and reset behaviour
  20. Review authentication and access controls
  21. Review confidentiality and integrity controls
  22. Check data minimisation
  23. Review availability and network impact
  24. Limit exposed interfaces and attack surfaces
  25. Assess exploitation mitigation
  26. Review logging and relevant opt-out
  27. Test secure deletion and data transfer
  28. Review update authenticity and integrity
  29. Plan automatic security-update behaviour and opt-out
  30. Publish a coordinated disclosure policy
  31. Publish and monitor a security contact and security.txt
  32. Record the Article 14 awareness timestamp process
  33. Confirm SRP access and coordinator route
  34. Prepare 24-hour and 72-hour draft templates
  35. Define separate final-report anchors for vulnerabilities and incidents
  36. Run a reporting drill including the backup owner
  37. Document the support-period rationale and end date
  38. Prepare Annex II user information
  39. Assemble Annex VII evidence and Annex V declaration draft
  40. Plan ten-year record and update-availability retention duties

The support-period minimum is not automatically sufficient for every product. Reporting already applies, while most remaining CRA obligations apply from 11 December 2027. Use the deadline guide and the reporting guide to interpret the relevant checks.

Keep a printable copy.

The PDF includes all forty checks with space for a review. We email a download link after your request. Your details are used to respond to this request, with no newsletter subscription.

We use your details only to respond to this request.