What it is for
This plan groups the preparation work for the Cyber Resilience Act into six workstreams. Each item is a suggested deliverable: a recommendation that cites the provisions motivating it, not a legal obligation in itself. It is written mainly from a manufacturer's perspective; importers, distributors and open-source software stewards should keep only the items relevant to their role.
What the text requires
Two dates frame the plan: Article 14 (reporting obligations) applies from 11 September 2026 and the Regulation applies from 11 December 2027 (Article 71(2)). The obligations of Article 14 also apply to in-scope products placed on the market before 11 December 2027 (Article 69(3)).
How to use it
- Start with workstream 1 (scoping) for each product; the other workstreams depend on it.
- Read the cited provisions before planning an item; delete what does not apply to your role and add your own items.
- Assign an owner and a target date to each item.
- Keep the evidence produced (documents, procedures, records): it feeds the technical documentation and the answers to market surveillance authorities.
- Review the plan when delegated acts, implementing acts, harmonised standards or official guidance are published.
Good practice (recommendation, not a legal requirement)
Every item below is a recommendation. Where an item reflects an obligation, the obligation lies in the cited provision, with its exact conditions and exceptions — read it there.
1. Governance and scoping
| # | Suggested deliverable | Provisions |
|---|---|---|
| 1.1 | An owner for CRA preparation and an inventory of products with digital elements and versions | Article 2(1), Article 3, point (1) |
| 1.2 | A documented scoping analysis per product (see the scoping checklist) | Article 2, Article 3, point (2), Article 3, point (22) |
| 1.3 | Your role per product and market, including cases where an importer, distributor or other person is considered a manufacturer | Article 3, point (12), Article 21, Article 22(1) |
| 1.4 | A check of each product against the categories of Annexes III and IV, using the technical descriptions adopted under Article 7(4) when available | Article 7(1), Article 7(4), Article 8(1), first subparagraph |
| 1.5 | A timeline per product (Article 14 from 11 September 2026; general application from 11 December 2027) | Article 71(2), Article 69(2), Article 69(3) |
2. Secure design and development (Annex I, Part I)
| # | Suggested deliverable | Provisions |
|---|---|---|
| 2.1 | A documented, up-to-date cybersecurity risk assessment per product, used across planning, design, development, production, delivery and maintenance | Article 13(2), Article 13(3), Article 13(4) |
| 2.2 | A gap analysis against Part I of Annex I, with a justification where a requirement is considered not applicable | Article 13(1), Annex I, Part I |
| 2.3 | A due-diligence procedure and inventory for third-party components, including free and open-source components | Article 13(5), Article 13(6) |
| 2.4 | A review of default configurations, reset, update mechanisms, access control and data protection | Annex I, Part I, point 2(b), Annex I, Part I, point 2(c), Annex I, Part I, point 2(d), Annex I, Part I, point 2(e) |
3. Vulnerability handling and support period (Annex I, Part II)
| # | Suggested deliverable | Provisions |
|---|---|---|
| 3.1 | A software bill of materials in a commonly used, machine-readable format covering at least top-level dependencies | Annex I, Part II, point 1, Article 13(24) |
| 3.2 | A coordinated vulnerability disclosure policy, a reporting contact address and a single point of contact for users | Annex I, Part II, point 5, Annex I, Part II, point 6, Article 13(17) |
| 3.3 | A security update process: remediation without delay, separate security updates where technically feasible, secure distribution, dissemination with advisories | Annex I, Part II, point 2, Annex I, Part II, point 7, Annex I, Part II, point 8 |
| 3.4 | A support period per product, the information used to set it, and how its end date is shown at purchase | Article 13(8), second subparagraph, Article 13(8), third subparagraph, Article 13(19), first subparagraph |
| 3.5 | Availability of each security update for at least 10 years after issue or for the remainder of the support period, whichever is longer | Article 13(9) |
| 3.6 | A procedure to disclose information on fixed vulnerabilities once an update is available | Annex I, Part II, point 4 |
What the text requires
The support period must reflect the time during which the product is expected to be in use. Without prejudice to the second subparagraph, the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time. Article 13(8), third subparagraph
4. Reporting readiness (Article 14)
| # | Suggested deliverable | Provisions |
|---|---|---|
| 4.1 | Criteria to detect and qualify actively exploited vulnerabilities and severe incidents | Article 3, point (42), Article 14(5) |
| 4.2 | Notification templates and an on-call procedure for the deadlines of Article 14 | Article 14(2), Article 14(4) |
| 4.3 | Identification of the CSIRT designated as coordinator and access to the single reporting platform | Article 14(7), Article 16(1) |
| 4.4 | A process and channels to inform impacted users | Article 14(8) |
The vulnerability handling workflow template details the reporting steps and their deadlines as written in Article 14.
5. Documentation and conformity
| # | Suggested deliverable | Provisions |
|---|---|---|
| 5.1 | Technical documentation with at least the elements of Annex VII, kept up to date during the support period | Article 31(1), Article 31(2), Annex VII |
| 5.2 | The choice of conformity assessment procedure per product and any notified body planning; tracking of harmonised standards | Article 32(1), Article 32(2), Article 32(3), Article 32(4), Article 27(1) |
| 5.3 | The EU declaration of conformity and CE marking arrangements | Article 28(1), Article 30(1), Article 13(20) |
| 5.4 | The information and instructions to the user listed in Annex II | Annex II, Article 13(18) |
| 5.5 | Retention of documentation for at least 10 years or the support period, whichever is longer | Article 13(13) |
6. Supply chain and monitoring
| # | Suggested deliverable | Provisions |
|---|---|---|
| 6.1 | Verification checklists for importers and distributors before placing or making available | Article 19(2), Article 20(2) |
| 6.2 | Agreed channels for vulnerability information between economic operators | Article 19(5), second subparagraph, Article 20(4), second subparagraph, Article 13(6) |
| 6.3 | Records of the economic operators who supplied you and whom you supplied, kept for 10 years | Article 23(1), Article 23(2) |
| 6.4 | Monitoring of delegated and implementing acts, harmonised standards and guidance | Article 7(4), Article 13(24), Article 14(10), Article 26 |
| 6.5 | For microenterprises and small enterprises: a check of national support measures | Article 33(1) |
Fictional example — Sequencing at Acme Sensors
Acme Sensors, an invented company selling connected sensors with a cloud dashboard, starts with workstream 1 in the first month, then runs workstreams 3 and 4 in parallel because the reporting obligations apply first, and schedules workstreams 2 and 5 product by product according to its release calendar. This sequencing is an illustration, not a recommendation for every organisation.
Downloadable version
The Excel workbook and the Word document contain the same 29 items, with the motivating provisions and a note for each, and empty Status, Owner and Notes columns.