How far are you technically with the Cyber Resilience Act?
Eight questions about the technical requirements the CRA places on manufacturers of software and connected products. For every no, you see what lies behind it and where to start. Only you see the result.
The self-check covers the technical side. Whether and how the CRA applies to your product is a legal question and remains with your lawyers.
The eight questions
Answer off the cuff. If you do not know, the honest answer is usually no.
- 01
Do you know which of your products fall under the Cyber Resilience Act, and in which category?
- 02
Does your build pipeline automatically generate a Software Bill of Materials (SBOM) with every release?
- 03
Are your dependencies continuously checked against known vulnerabilities, not only before a release?
- 04
Could you detect, assess and report an actively exploited vulnerability within 24 hours, including at the weekend?
- 05
Does a security patch reach your customers in less than five working days?
- 06
Are your updates signed, and can customers obtain them without manual work?
- 07
Is there a published contact where third parties can report vulnerabilities in your product?
- 08
Is it defined for every product how long you will provide security updates?
0 of 8 answered
From assessment to roadmap
The self-check shows where it sticks. Where your development concretely stands against the technical CRA requirements, which gaps to close first and what that costs is what CRA Software Readiness clarifies at a fixed price.
30 minutes, no obligationQuestions about the self-check
Who is the CRA self-check for?
For management, engineering leads and product owners at manufacturers that place software or connected products on the EU market and want to know how far their development is technically. It does not replace an analysis, but it shows in two minutes where the questions lie.
Which deadlines apply under the Cyber Resilience Act?
Since 11 September 2026, the reporting obligations for actively exploited vulnerabilities and severe incidents apply. From 11 December 2027, all remaining requirements of Regulation (EU) 2024/2847 apply, including CE marking for products placed on the market from then on.
Is the result a conformity assessment?
No. The self-check asks about technical prerequisites, not conformity. The legal classification of the product, the conformity assessment and any certification remain with your lawyers and, if required, a notified body.
What happens to my answers?
Nothing. The answers stay in your browser; there is no transmission, no storage and no sign-up. If you want to discuss the result, book a call and bring the answers yourself.