BetaThis check is new and still being refined. It is a readiness check built on the regulation's manufacturer obligations, not legal advice and not a conformity assessment. Your answers stay in your browser. Tell me what you think.
How ready are you for the Cyber Resilience Act?
The EU Cyber Resilience Act's reporting duties have applied since 11 September 2026 and the full obligations apply to products placed on the market from 11 December 2027; UK PSTI is already in force. Most of the companies it covers have no compliance department. This check asks about the eight things you must be able to show, in the order that takes longest, and gives you a readiness picture against each with the first step for every gap. Fourteen months is enough for a company of this size if you start with the long items. Answer from what you know today; nothing is uploaded.
About 25 questions · 8 to 10 minutes. The CRA Readiness Check needs JavaScript to run; if it has not loaded, book a conversation instead.
The eight obligations
- Support period and updates The item that takes longest: a support period you can keep, and a safe way to update every unit in the field.
- Vulnerability handling A disclosure policy, a contact, and a named person running the process.
- Reporting The 24-hour reporting duty for actively exploited vulnerabilities and severe incidents has applied since 11 September 2026.
- Software bill of materials A machine-readable list of what is in the product, kept current and used to find vulnerable components.
- Secure at release and by default Tested by someone who did not write it, no default passwords, and the data it handles protected.
- Classification and conformity route Which class the product is in decides whether you self-assess or need a third party, and how long that takes.
- Technical documentation The risk assessment and the technical file: writing down what a good team has already done, and keeping it.
- Declaration, marking and user information The paperwork that summarises the rest: identification on the product, the importer, the user information, the declaration and the CE mark.