---
title: "CRA checklist for machine builders | logiccloud"
description: "The Cyber Resilience Act checklist: who is affected, which reporting deadlines apply since 11 Sep 2026 and what your installed base needs by 11 Dec 2027."
url: https://logiccloud.com/en/cra/checklist/
language: en-GB
---

CRA knowledge center · Checklist

# The CRA checklist for machine builders.

What has applied since 11 September 2026 and what must be in place by 11 December 2027 — point by point, ready to tick off.

Free to use, no sign-up. Tip: use your browser's print function to save the checklist as a PDF.

Step 1

## Are you affected?

The CRA applies to manufacturers of products with digital elements. Check for your product line:

- ### You develop the machine, or have it developed, and sell it under your own name or brand.
- ### The machine has a direct or indirect data connection — a networked controller, remote maintenance access or a cloud connection.
- ### You sell the machine in the EU.
- ### Machines already delivered count too: the reporting duty covers every product in scope, older ones included.

If the first three points apply, the reporting duties apply to you today.

Step 2 · in force since 11 Sep 2026

## Know the reporting deadlines.

Actively exploited vulnerabilities and severe security incidents are reported through ENISA's reporting platform. The clock starts at awareness — not when the issue is fixed.

- ### Early warning

  - Exploited vulnerability

    24 hours from awareness

  - Severe incident

    24 hours from awareness

- ### Detailed notification

  - Exploited vulnerability

    72 hours from awareness

  - Severe incident

    72 hours from awareness

- ### Final report

  - Exploited vulnerability

    14 days after a fix is available

  - Severe incident

    1 month after the 72-hour notification

You also inform the affected users yourself — the report to the authority does not replace that.

Step 3 · do it now

## Organise the reporting duty.

- 01

  ### Clarify who is responsible

  Which national CSIRT is yours? It depends on where decisions about your products' cybersecurity are mainly taken.

- 02

  ### Set up access to the reporting platform

  Before an incident, not on the day of one.

- 03

  ### Name who reports

  One person, one deputy, one phone number. The clock runs from the company's awareness.

- 04

  ### Define the incoming channel

  How do you hear about an exploited vulnerability — support, service, suppliers, a public reporting point?

- 05

  ### Answer the inventory question

  Which software runs on which machine today, at which customer, in which country? This is the longest point.

Step 4 · by 11 Dec 2027

## Get your installed base under control.

From 11 December 2027 the remaining requirements apply. Can you already …

- ### Distribute security updates to machines in the field?
- ### See which software version runs on which machine?
- ### Manage machines and edge systems centrally?
- ### Document changes and access traceably?
- ### Control users, roles and permissions centrally?
- ### Roll out updates in a controlled way and roll back if something goes wrong?

Every "no" is a field of action.

More background: [CRA reporting duty: 24 hours from awareness](https://logiccloud.com/en/cra-reporting-duty-24-hours-from-awareness/) and the [CRA knowledge center](https://logiccloud.com/en/cra/).

Note: this checklist explains the legal situation and is not legal advice. Which obligations apply to your company depends on your products. CRA conformity of the end product is the manufacturer's responsibility.

## Several points still open?

In the CRA assessment we go through the checklist with you, on your machines — and turn it into an action plan.

[Request a CRA assessment](https://logiccloud.com/en/contact/) [Request a demo](https://logiccloud.com/en/demo/)