The CRA defines 35 specific obligations covering:

Security by design (Annex I, Part I) build products with appropriate cybersecurity from the start
Vulnerability handling (Art. 13(6), Annex I, Part II) identify, document, and fix vulnerabilities throughout the support period
Software Bill of Materials (Art. 13(5)) maintain a machine-readable list of all components in your product
Security updates (Art. 13(8)) provide free security patches for at least 5 years
Incident reporting (Art. 14) report actively exploited vulnerabilities to ENISA within 24 hours
Technical documentation (Art. 13(12), Annex VII) maintain a Technical File with 8 sections
EU Declaration of Conformity (Art. 28, Annex VI) formally declare your product meets the requirements

CRANIS2 tracks all 35 obligations for your products and automatically derives status from your platform data, so you always know where you stand.

What is the CRA?

Select a station to begin