--- title: "EU Cyber Resilience Act (CRA) compliance" description: "Clearly AI assesses every product against the Cyber Resilience Act's essential requirements and drafts cited evidence for your technical file." canonical: https://clearly-ai.com/solutions/compliance/cyber-resilience-act --- _EU Cyber Resilience Act_ # Every product ready for the Cyber Resilience Act without growing your team The CRA requires a cybersecurity risk assessment and technical documentation for every product with digital elements sold in the EU. Clearly AI reads the specs, firmware lists, bills of materials, and design docs you already have, assesses each product against the CRA's essential requirements, and drafts the evidence for your technical file. Every finding cites its source, and your team approves every assessment. - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [See what the CRA requires](#requirements) Trusted by the companies you trust the most - HID Global - Ericsson - PayPal - Modern Health - Hagerty - Rivian - Infineon - Bastion ## Who writes the technical file for every product? The CRA applies product by product. For each product with digital elements, a manufacturer has to assess its cybersecurity risks, show how it meets the essential requirements, document how it handles vulnerabilities, and keep all of it current for the product's support period. For a manufacturer with a large portfolio, that's hundreds of risk assessments and technical files. Done by hand, the work lands on product engineers who should be building, and it takes months. Reporting obligations already apply, and the rest of the CRA applies in December 2027. That leaves limited time to find and fix gaps across the portfolio. ## Key CRA dates | Date | What applies | | --- | --- | | 10 December 2024 | The CRA (Regulation (EU) 2024/2847) enters into force | | 11 June 2026 | Rules for notifying conformity assessment bodies apply | | 11 September 2026 | Manufacturers must report actively exploited vulnerabilities and severe incidents (Article 14) | | 11 December 2027 | All remaining obligations apply, including the essential requirements, conformity assessment, and CE marking | ## What the CRA requires, and what Clearly AI produces | CRA requirement | What Clearly AI produces | | --- | --- | | Cybersecurity risk assessment (Article 13): Assess each product's risks, document them, and keep them up to date | A product-level threat model and risk assessment built from your design artifacts and versioned for each release | | Essential cybersecurity requirements (Annex I, Part I): Secure by default, access control, data protection, limited attack surface, logging, secure updates, and more | A requirement-by-requirement assessment that marks each one compliant, partially compliant, noncompliant, missing info, or not applicable, with the evidence behind it | | Vulnerability handling (Annex I, Part II): SBOM, coordinated vulnerability disclosure, and security updates | A check that each process is documented and evidenced, with gaps flagged | | Technical documentation (Annex VII): The evidence behind conformity | Draft risk assessment, control descriptions, and requirement mapping for your technical file, exported to PDF, Word, or your own Word template | | EU declaration of conformity (Article 28) | Draft supporting text for your declaration | | Vulnerability and incident reporting (Article 14): A 24-hour early warning, a 72-hour notification, and a final report | Clearly AI doesn't file reports. It keeps each product's current assessment on record, so your team has the product context at hand when a report is due. | _How it works_ ## From product documents to an approved CRA assessment 1. **Load the requirements** Upload the CRA's essential requirements, your requirement mapping, or your secure development standard. Clearly AI turns it into a versioned review template. 2. **Gather the evidence** Point Clearly AI at a product's specs, firmware lists, bills of materials, design docs, and tickets, or let a Jira ticket or intake request start the review. Clearly AI identifies the assets and functions in scope and the requirements that apply to them. 3. **Assess each requirement** Clearly AI evaluates each in-scope asset against the CRA and your own security policies, drafts findings, and cites the source behind every answer. When evidence is missing or conflicting, it says so instead of guessing. 4. **Approve and record** Your reviewer checks the draft, edits where they disagree, and approves it. Clearly AI records who approved it, when, and against which template version, and exports the evidence for your technical file. [See how workflows start reviews automatically](https://clearly-ai.com/platform/workflows) _Portfolio scale_ ## Every product in the portfolio, held to the same standard CRA work grows with every product you sell. Clearly AI lets the same team cover all of it. - **Same template, every product:** Run one versioned CRA template across the portfolio, so every product is assessed the same way, whichever team owns it - **Starts from what engineering already has:** Specs, firmware lists, BOMs, and design docs are the input. Engineers review findings instead of writing documentation from scratch. - **See where the portfolio stands:** Tag products by product line, business unit, or region, then see which have been assessed and which requirements fail most often across them [See how reporting works](https://clearly-ai.com/platform/resolve/reporting) ![Clearly AI reporting showing the requirements most often answered non-compliant across a product portfolio.](https://clearly-ai.com/reporting/patterns-2026-10.svg) _Gap analysis_ ## Find the gaps while there's still time to fix them The most useful output of an early CRA assessment is the list of what to fix. - **Missing evidence flagged:** When the evidence for a requirement is missing or conflicting, Clearly AI marks it missing info instead of assuming the product complies - **Gaps become engineering work:** Publish gaps to the risk registry and open a ticket in Jira, Linear, or ServiceNow with an owner and a fix-by date - **Tracked to a verified fix:** Each gap stays open in the risk registry until the fix is verified [See how fixes are verified](https://clearly-ai.com/platform/control-and-remediation-verification) ![A Clearly AI CRA assessment showing each requirement's result and the evidence behind it.](https://clearly-ai.com/solutions/cyber-resilience-act-assessment.svg) _Your requirements_ ## Your reading of the CRA, applied to every product The CRA's essential requirements are written at a high level. Your team decides what they mean for your products, and Clearly AI applies that decision every time. - **Your standards, live in hours:** Upload your secure development standards, control library, or requirement mapping. Clearly AI turns them into a review template in hours, not a six-month configuration project. - **Ready for harmonised standards:** Map assessments to harmonised standards as they're published, or to your own control set. Update the template, and new assessments use the new version. - **Every finding traced:** Each finding shows the requirement it was tested against and the document, page, and passage behind it [See how tuning and customization work](https://clearly-ai.com/platform/quality) ![A Clearly AI threat model finding opened from the findings list, with its cited source, reasoning, review history and the Publish to Risk Registry action.](https://clearly-ai.com/solutions/third-party-risk-vendor-findings.svg) _Support period_ ## Kept current for as long as the product is supported The CRA expects each product's risk assessment to stay up to date for its support period, which is generally at least five years. - **Rerun on every release:** When a product changes, rerun its assessment against the same template. Reviews can start automatically from Jira or GitHub. - **Versioned history:** Each assessment is tied to the product state and template version it ran against, so you can show what was assessed and when - **Changes caught early:** Clearly AI compares new designs against the existing threat model and flags the changes that affect security [See continuous threat modeling](https://clearly-ai.com/solutions/continuous-threat-modeling) [See how auditability and versioning work](https://clearly-ai.com/platform/quality) _Radio Equipment Directive_ ## Already working on RED? Carry it forward to the CRA. Since 1 August 2025, internet-connected radio equipment sold in the EU has had to meet the cybersecurity requirements of the Radio Equipment Directive (RED), covering network protection, personal data and privacy, and fraud prevention. Delegated Regulation (EU) 2026/339 repeals those requirements from 11 December 2027, when the CRA applies in full, so radio products move under the CRA. - **RED assessments today:** Clearly AI assesses radio products against the RED cybersecurity requirements and drafts technical file and declaration of conformity text - **One product context for both:** The product context and evidence from your RED work carry into your CRA assessment, so your team doesn't start over [Read our guide to EU RED compliance](https://clearly-ai.com/blog/navigating-eu-red-compliance-meeting-the-august-2025-deadline) _Proven outcomes_ ## Hundreds of products, documented by the same team - **90%** Faster documentation turnaround - **300+** Products onboarded in under 3 months - **75%** Reduction in engineering time spent on compliance tasks HID Global's results come from preparing its product portfolio for the Radio Equipment Directive. > Weeks to minutes, literally. > > — William Brown, Sr. Director of Product Security and Privacy, HID Global [Read the HID Global story](https://clearly-ai.com/customer-stories/hid-global) _FAQ_ ## Answers to your top questions ### What is the EU Cyber Resilience Act? The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for products with digital elements sold in the EU, including connected hardware and software. Manufacturers must assess cybersecurity risks, meet the essential requirements, handle vulnerabilities, and document conformity before placing products on the market. ### When does the CRA apply? The CRA entered into force on 10 December 2024. Reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026. All remaining obligations, including the essential requirements and CE marking, apply from 11 December 2027. ### Which products are in scope? Most hardware and software products with digital elements that connect to a device or network and are sold in the EU. Products covered by their own sector rules, such as medical devices, motor vehicles, and civil aviation, are excluded. Some product categories are classed as important or critical and need a stricter conformity assessment. ### What are the CRA's reporting deadlines? Manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, and a notification within 72 hours. A final report follows within 14 days of a fix being available for a vulnerability, or within one month for a severe incident. Reports go to the coordinating national CSIRT and ENISA through a single reporting platform. ### What are the penalties for non-compliance? Fines for breaching the essential requirements or manufacturer obligations can reach EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. ### Does Clearly AI make our products CRA compliant? No. No tool can. Clearly AI assesses each product against the CRA's requirements, flags the gaps, and drafts the documentation for your technical file. Your team fixes the gaps, approves the assessments, and remains responsible for conformity. ### Does Clearly AI file CRA vulnerability reports? No. Clearly AI doesn't file reports with ENISA or national CSIRTs. It keeps each product's current assessment on record, so your team has the product context at hand when a report is due. ### How does the CRA relate to the Radio Equipment Directive? RED cybersecurity requirements have applied to internet-connected radio equipment since 1 August 2025. Delegated Regulation (EU) 2026/339 repeals them from 11 December 2027, when the CRA applies in full, so radio products move under the CRA. Clearly AI assesses products against both, and the evidence from your RED work carries into your CRA assessment. ### What does Clearly AI need to run a CRA assessment? The documents your teams already have: specs, firmware lists, bills of materials, design docs, architecture diagrams, tickets, and code. Clearly AI gathers that context itself and marks a requirement missing info when the evidence isn't there. [See all integrations](https://clearly-ai.com/integrations) ### Can we use our own interpretation of the CRA requirements? Yes. Upload your secure development standards, control library, or requirement mapping, and Clearly AI applies it as a versioned review template. When your interpretation changes, update the template, and you can rerun past assessments against it. [See how tuning and customization work](https://clearly-ai.com/platform/quality) ### Is Clearly AI a continuous compliance monitoring tool? No. Clearly AI doesn't watch running products or devices. Each assessment is a point-in-time review of a specific product version, run when a product is designed, released, or changed, or on a schedule you set. Every assessment is versioned, so each one builds on the last. ## Bring your CRA requirement mapping to the demo We'll show how it becomes a review template, then walk a sample connected product from source documents to an approved CRA assessment, with every gap cited to its source. - [Contact Enterprise Sales](https://clearly-ai.com/demo) [See all regulations](https://clearly-ai.com/solutions/compliance) ## Learn more - [Secure everything that ships](https://clearly-ai.com) - [We built the tool we wished we had](https://clearly-ai.com/about-us) - [One platform. From intake to remediation.](https://clearly-ai.com/platform) - [Know everything that needs a review. Skip the 300-question form.](https://clearly-ai.com/platform/security-intake) - [Ask only what matters. Get it right the first time.](https://clearly-ai.com/platform/conversational-intake) - [Every finding, tracked to a decision](https://clearly-ai.com/platform/resolve/risk-registry) - [Show leadership and auditors exactly what security reviewed](https://clearly-ai.com/platform/resolve/reporting) - [Security reviews you can stand behind, every time](https://clearly-ai.com/platform/quality) - [Threat models built from the tools you already use](https://clearly-ai.com/integrations) - [Threat models that know about today's attacks](https://clearly-ai.com/platform/threat-intelligence) - [Automate every step around the review](https://clearly-ai.com/platform/workflows) - [Threat models your teams can work on together](https://clearly-ai.com/platform/collaboration) - [Understand the system before the review starts](https://clearly-ai.com/platform/enterprise-context-graph) - [Trust, security, and deployment](https://clearly-ai.com/platform/trust-security-and-deployment) - [Every plan reviewed. Every risky change threat modeled.](https://clearly-ai.com/platform/ide-and-mcp) - [Verify what actually shipped](https://clearly-ai.com/platform/control-and-remediation-verification) - [A current threat model for everything that ships](https://clearly-ai.com/solutions/continuous-threat-modeling) - [Prove every product that ships meets your security bar](https://clearly-ai.com/solutions/product-security-assurance) - [Privacy reviews your team can stake decisions on](https://clearly-ai.com/solutions/privacy) - [Every vendor reviewed against your standards](https://clearly-ai.com/solutions/third-party-risk) - [Review every design before it's built](https://clearly-ai.com/solutions/design-and-architecture-reviews) - [Secure the AI you build, buy, and code with](https://clearly-ai.com/solutions/ai-agentic-security) - [Every regulation you answer to. One review process.](https://clearly-ai.com/solutions/compliance) - [Every product ready for the Cyber Resilience Act without growing your team](https://clearly-ai.com/solutions/compliance/cyber-resilience-act) - [Build vs. buy for security review automation](https://clearly-ai.com/compare/claude-chatgpt) - [The ThreatModeler alternative built from your own docs, code, and policies](https://clearly-ai.com/compare/threatmodeler) - [The Clover Security alternative with findings your team can trust](https://clearly-ai.com/compare/clover) - [The Prime Security alternative for every review your team runs](https://clearly-ai.com/compare/prime) - [Security and Privacy](https://clearly-ai.com/trust/security-privacy) - [Clearly AI Privacy Policy](https://clearly-ai.com/trust/privacy-policy) - [Clearly AI Subprocessors](https://clearly-ai.com/trust/subprocessors) - [AI Risk Reviews](https://clearly-ai.com/use-cases/ai-risk-reviews) - [Automate Triage](https://clearly-ai.com/use-cases/automate-triage) - [Privacy Impact Assessments](https://clearly-ai.com/use-cases/privacy-impact) - [Vendor Risk Assessments](https://clearly-ai.com/use-cases/vendor-risk) - [Threat Modeling](https://clearly-ai.com/use-cases/threat-modeling) - [Contact](https://clearly-ai.com/contact) - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [Latest from the Clearly AI blog](https://clearly-ai.com/blog) - [In the news](https://clearly-ai.com/press) - [How Ericsson Enterprise Wireless Solutions cut review times by up to 80%](https://clearly-ai.com/customer-stories/ericsson) - [How HID Global reviews 300+ products for the Radio Equipment Directive with the team it already has](https://clearly-ai.com/customer-stories/hid-global) - [How Rivian scaled privacy and AI governance reviews 4x without adding headcount](https://clearly-ai.com/customer-stories/rivian) - [Part 2! Okay, privacy is different from security. Now what?](https://clearly-ai.com/blog/part-2-okay-privacy-is-different-from-security-now-what) - [How AI is rewiring our product engineering workflow](https://clearly-ai.com/blog/how-ai-is-rewiring-our-product-engineering-workflow) - [Good Data Scientists and Bad Outcomes, Part 1: What's the difference between security and privacy work?](https://clearly-ai.com/blog/good-data-scientists-and-bad-outcomes-what-s-the-difference-between-security-and-privacy-work) - [Why I Joined Clearly AI](https://clearly-ai.com/blog/why-vp-marketing-joined-clearly-ai) - [Skip the Marketing: Clearly AI for Technical People](https://clearly-ai.com/blog/clearly-ai-technical-explanation) - [Clearly AI Raises $8.4M Seed Round to Scale Product Security](https://clearly-ai.com/blog/seed-round) - [Why We Started Clearly AI](https://clearly-ai.com/blog/why-we-started-clearly-ai) - [Applying AI to Threat Modeling - Where AI Thrives, Survives, and Dies](https://clearly-ai.com/blog/applying-ai-to-threat-modeling) - [Why We Build in Public](https://clearly-ai.com/blog/why-we-build-in-public) - [Solving the Threat Modeling Bottleneck with AI Workflows](https://clearly-ai.com/blog/solving-the-threat-modeling-bottleneck-with-ai-workflows) - [Clearly AI Named Finalist in the 2025 Okta Startup Challenge](https://clearly-ai.com/blog/clearly-ai-named-finalist-in-the-2025-okta-startup-challenge) - [Security, SOC 2, & Startups](https://clearly-ai.com/blog/security-soc-2-startups) - [Building Reliable AI Systems for Security and Privacy Reviews](https://clearly-ai.com/blog/building-reliable-ai-systems-for-security-and-privacy-reviews) - [How to Automate Security and Privacy Reviews with Clearly AI](https://clearly-ai.com/blog/how-to-automate-security-and-privacy-reviews-with-clearly-ai) - [One Year of Clearly AI](https://clearly-ai.com/blog/one-year-of-clearly-ai) - [Navigating EU RED Compliance: Meeting the August 2025 Deadline](https://clearly-ai.com/blog/navigating-eu-red-compliance-meeting-the-august-2025-deadline) - [The AI Engineer Cheat Sheet](https://clearly-ai.com/blog/the-ai-engineer-cheat-sheet) - [Intelligent Vendor Risk Assessments](https://clearly-ai.com/blog/intelligent-vendor-risk-assessments) - [Clearly AI wins the AWS Bedrock Builder's Challenge](https://clearly-ai.com/blog/clearly-ai-wins-the-aws-bedrock-builder-s-challenge) - [Reviews, reviews, reviews!](https://clearly-ai.com/blog/reviews-reviews-reviews) - [Halfway through YC](https://clearly-ai.com/blog/halfway-through-yc) - [llms.txt — site overview for LLMs](https://clearly-ai.com/llms.txt) - [llms-full.txt — full site content for LLMs](https://clearly-ai.com/llms-full.txt) - [sitemap.xml — all public routes](https://clearly-ai.com/sitemap.xml) - [Documentation](https://docs.clearly-ai.com/docs) [Canonical page](https://clearly-ai.com/solutions/compliance/cyber-resilience-act)