CRA essential cybersecurity requirements

CRA Annex I Part I: the essential cybersecurity requirements for the product itself

Direct answer. Part I of Annex I to Regulation (EU) 2024/2847 is headed “Cybersecurity requirements relating to the properties of products with digital elements.” Point (1) says products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks. Point (2) says that, on the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall meet points (a) to (m) below, in the annex’s own words. Article 13(1) says: “When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.” Vulnerability handling is Part II, on a separate page. When the regulation applies is the CRA timeline. This page is not legal advice.

CRALedger Duty Records (Shopify App Store · Write a review) tracks product roles, checklists, and open record gaps. The listing does not say the app designs a product, decides that Annex I Part I is met, or draws up a software bill of materials. The manufacturer article is CRA manufacturer obligations.

Related: EUDR Records Manager — DDS reference numbers on supplier lots.

Free check first: CRA role and scope self-check runs in your browser and sends nothing. Describe a product and your role and see which articles of Regulation (EU) 2024/2847 to read.

Checklist before you treat Part I as done

• Point (1) is the design, development, and production duty: an appropriate level of cybersecurity based on the risks. It is not optional in the annex’s sentence.
• Point (2) opens with the Article 13(2) risk assessment and the words “where applicable.” Points (a) to (m) are that point. Do not drop one because another point sounds similar.
• Part II is vulnerability handling, including the software bill of materials. That page is CRA vulnerability handling. The bill of materials alone is CRA SBOM requirements.
• Article 13(1) is the placing-on-the-market sentence for Part I. The rest of the manufacturer article is CRA manufacturer obligations.
• The support-period end date on the product page is the support-period page. Article 14 reporting is a different article. Application dates are the timeline.

Point (1) and point (2), in the annex’s words

The consolidated text opened for this page, CELEX 02024R2847-20241120, sets Part I out as follows. Confirm the live annex.

• (1) Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks.
• (2) On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:
• (a) be made available on the market without known exploitable vulnerabilities;
• (b) be made available on the market with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made product with digital elements, including the possibility to reset the product to its original state;
• (c) ensure that vulnerabilities can be addressed through security updates, including, where applicable, through automatic security updates that are installed within an appropriate timeframe enabled as a default setting, with a clear and easy-to-use opt-out mechanism, through the notification of available updates to users, and the option to temporarily postpone them;
• (d) ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access;
• (e) protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means;
• (f) protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, and report on corruptions;
• (g) process only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of the product with digital elements (data minimisation);
• (h) protect the availability of essential and basic functions, also after an incident, including through resilience and mitigation measures against denial-of-service attacks;
• (i) minimise the negative impact by the products themselves or connected devices on the availability of services provided by other devices or networks;
• (j) be designed, developed and produced to limit attack surfaces, including external interfaces;
• (k) be designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques;
• (l) provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user;
• (m) provide the possibility for users to securely and easily remove on a permanent basis all data and settings and, where such data can be transferred to other products or systems, ensure that this is done in a secure manner.

Article 13(1) and the pages this one does not repeat

Article 13(1) ties Part I to placing on the market in the sentence quoted in the direct answer. Point (2) of the annex points at the cybersecurity risk assessment in Article 13(2) for the “where applicable” test. How that assessment is documented, and the other manufacturer duties in Article 13, are CRA manufacturer obligations. This page does not restate those paragraphs.

Part II of the same annex is vulnerability handling. Its eight points, including the software bill of materials, are CRA vulnerability handling. Format and the technical-documentation job of the bill of materials are CRA SBOM requirements. The end date shown at purchase is the support-period product page. Actively exploited vulnerabilities and severe incidents are Article 14. When the obligations apply is the timeline, which follows Article 71, and the Commission’s Cyber Resilience Act page. This page does not restate those dates.

What this page is not

• Not legal advice, a conformity assessment, or a finding that a product meets Part I.
• Not Annex I Part II. That URL is CRA vulnerability handling.
• Not the SBOM page, the support-period page, or the Article 14 page. Those URLs are linked above.
• Not a substitute for the live annex on EUR-Lex.

Related pages

• CRA role and scope self-check
• CRA vulnerability handling — Annex I Part II
• CRA SBOM requirements
• CRA support period on the product page
• CRA manufacturer obligations
• CRA Article 14 incident deadlines
• Cyber Resilience Act timeline
• Consolidated Regulation (EU) 2024/2847 — Annex I Part I and Article 13
• European Commission: Cyber Resilience Act
• CRALedger Duty Records — live App Store listing
• Shopify apps hub
• Tools

Not legal advice. Confirm Annex I Part I and Article 13 on the live consolidated text before you treat a product property as in or out of the essential requirements. The app tracks records you keep. It does not decide conformity.