Question 1

What do I have to do right now?

Accepted Answer

Be ready to report. Since 11 September 2026, Article 14 reporting applies to in-scope products, including those released earlier (CRA Art. 69(3), 71(2)). Most other items on this list apply from 11 December 2027.

Question 2

Does this checklist apply to products I sold before December 2027?

Accepted Answer

Only the reporting part, unless you substantially modify the product from 11 December 2027 (CRA Art. 69(2)–(3)). For software, the Commission treats each version as placed on the market when first offered (Guidance ¶13–15).

Question 3

Do I need a notified body?

Accepted Answer

Not for the default class, which may use internal control (module A). Class I products need one unless they apply in full harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least "substantial"; Class II and critical products use third-party routes, except that open-source software in Annex III categories may use any Art. 32(1) route if its technical documentation is made public (CRA Art. 32(1)–(5)).

Question 4

Is five years of security updates always the minimum?

Accepted Answer

Five years is the floor unless the product is expected to be in use for less; longer expected use means a longer period (CRA Art. 13(8); Guidance ¶126).

Question 5

Must I publish my SBOM?

Accepted Answer

No. "Manufacturers should not be obliged to make the SBOM public" (CRA Recital 77). Keep it in the technical documentation (CRA Annex VII).

Question 6

Are small companies treated differently?

Accepted Answer

Partly. They are not fined for missing the 24-hour early warning (CRA Art. 64(10)(a)), conformity assessment fees must be reduced proportionately (CRA Art. 32(6)), and Member States must offer awareness, advice and testing support (CRA Art. 33(1)). The substantive duties are the same.