CRA knowledge center · Checklist

The CRA checklist for machine builders.

What has applied since 11 September 2026 and what must be in place by 11 December 2027 — point by point, ready to tick off.

Free to use, no sign-up. Tip: use your browser's print function to save the checklist as a PDF.

Step 1

Are you affected?

The CRA applies to manufacturers of products with digital elements. Check for your product line:

  • You develop the machine, or have it developed, and sell it under your own name or brand.

  • The machine has a direct or indirect data connection — a networked controller, remote maintenance access or a cloud connection.

  • You sell the machine in the EU.

  • Machines already delivered count too: the reporting duty covers every product in scope, older ones included.

If the first three points apply, the reporting duties apply to you today.

Step 2 · in force since 11 Sep 2026

Know the reporting deadlines.

Actively exploited vulnerabilities and severe security incidents are reported through ENISA's reporting platform. The clock starts at awareness — not when the issue is fixed.

  • Early warning

    Exploited vulnerability
    24 hours from awareness
    Severe incident
    24 hours from awareness

  • Detailed notification

    Exploited vulnerability
    72 hours from awareness
    Severe incident
    72 hours from awareness

  • Final report

    Exploited vulnerability
    14 days after a fix is available
    Severe incident
    1 month after the 72-hour notification

You also inform the affected users yourself — the report to the authority does not replace that.

Step 3 · do it now

Organise the reporting duty.

  • 01

    Clarify who is responsible

    Which national CSIRT is yours? It depends on where decisions about your products' cybersecurity are mainly taken.

  • 02

    Set up access to the reporting platform

    Before an incident, not on the day of one.

  • 03

    Name who reports

    One person, one deputy, one phone number. The clock runs from the company's awareness.

  • 04

    Define the incoming channel

    How do you hear about an exploited vulnerability — support, service, suppliers, a public reporting point?

  • 05

    Answer the inventory question

    Which software runs on which machine today, at which customer, in which country? This is the longest point.

Step 4 · by 11 Dec 2027

Get your installed base under control.

From 11 December 2027 the remaining requirements apply. Can you already …

  • Distribute security updates to machines in the field?

  • See which software version runs on which machine?

  • Manage machines and edge systems centrally?

  • Document changes and access traceably?

  • Control users, roles and permissions centrally?

  • Roll out updates in a controlled way and roll back if something goes wrong?

Every "no" is a field of action.

More background: CRA reporting duty: 24 hours from awareness and the CRA knowledge center.

Note: this checklist explains the legal situation and is not legal advice. Which obligations apply to your company depends on your products. CRA conformity of the end product is the manufacturer's responsibility.