What kind of risk is the CRA on the risk map, and how is its impact estimated?
Under Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies, the CRA is a compliance risk; for a company exporting products to the EU it is in substance a market access risk, because non-compliant products may not be placed on the EU market.
Inputs to the impact assessment:
- Article 64 fines: up to EUR 15 million or 2.5% of worldwide annual turnover for breach of the essential requirements (whichever is higher)
- The product lines affected and their EU revenue
- Customer requirements and reputational damage, which usually come before fines
The principles cover listed companies; companies that are not public companies are not covered and can use them voluntarily.
What does the CRO need to confirm about the reporting obligations that apply from 11 September 2026?
The Article 14 reporting obligations apply from 11 September 2026 and cover products placed on the EU market before 11 December 2027 (Articles 69(3) and 71(2)). After becoming aware of an actively exploited vulnerability or a severe incident, via the single reporting platform: an early warning within 24 hours and a notification within 72 hours; the final report is due within 14 days after a corrective measure is available for vulnerabilities, and within one month after the notification for incidents.
The CRO should confirm three things:
- The reporting contact is authorised in advance; otherwise 24 hours cannot be met
- An Article 14 external route has been added to the existing security incident reporting procedure, with separate triggers and external contacts
- The reporting process is not scheduled after conformity assessment
Who should lead the CRA, and where does the CRO sit in the three lines?
The CRA does not name a department; the obligated party is the "manufacturer" as a legal entity (Article 13). In practice:
- Accountable: the product business unit with authority over product design and market launch decisions
- Second line: product security or compliance provides expertise, monitoring and challenge
- Third line: internal audit provides independent assurance
The touchpoint for the CRO and the risk management promotion unit is listing the CRA as a compliance risk within the existing risk management policy and regular reporting (Articles 13, 15 and 18 of the principles). The rule: each task has only one accountable party, and "accountable" and "independent assurance" should not sit with the same person.
Is there a CRA certificate? What should the board report on compliance status show?
There is no standalone "CRA certificate". Products with digital elements complete conformity assessment, sign an EU declaration of conformity and then carry CE marking (Articles 28, 30, 32):
| Product category | Assessment route |
|---|---|
| Default products | Self-assessment by the manufacturer under Annex VIII module A |
| Important products, class I | Self-assessment only when harmonised standards, common specifications or an EU cybersecurity certification scheme are applied; otherwise a notified body |
| Important products class II, critical products | A notified body or EU cybersecurity certification must be involved |
The board report can be organised by product line: category, assessment route, and completion of technical documentation and vulnerability handling. ISO 27001 is an organisation-level security management standard, not a CRA harmonised standard.
Which schedule risks are outside the company's control?
- Harmonised standards: as of August 2026, no CRA harmonised standard had been published in the Official Journal; class I important products without a usable harmonised standard need a notified body in the plan and budget
- Notified body scheduling: where third-party assessment is required, the timeline depends on the notified body
- Radio equipment switch: RED Delegated Regulation (EU) 2022/30 ceases to apply from 11 December 2027, after which radio equipment cybersecurity follows the CRA
- AI features: where a product is also covered by the EU AI Act, risk assessment and technical documentation must cover both
The recommended approach is to design and prepare now against published draft standards, then run a gap check once the standards are formally published.
How does Winners Consulting help CROs with the EU CRA?
- Decide first: whether the product is in CRA scope, which category it falls into and which conformity assessment route it takes (type-approved vehicle components, for example, are excluded)
- Build the requirements: the vulnerability handling process required by Annex I, the SBOM and Annex VII technical documentation, with the Article 14 reporting process ready
- One set of documents: a single document system built on the common requirements of the CRA, NIS2 and the EU AI Act, supporting audits under several laws at once
- Separate roles: Winners Consulting is the consultant and does not carry out conformity assessment; vice-president and director-level consultants lead personally end to end, never outsourced; 90 days of follow-up after go-live
EU CRA compliance, Who leads CRA, How long CRA compliance takes, Choosing a CRA consultant. Request a free mechanism diagnosis
How other roles see this service
- CEOEU CRA for the CEO: European orders, penalties and ownership. What to decide now
- CISOCISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CFOCFO view of the EU CRA and EU AI Act: EU revenue risk, penalties and budgeting
- CTOEU CRA for CTOs: what changes in development, SBOM and launch timing?
- Product managerEU CRA for product managers: is my product in scope, and what must be ready before launch?
Other services for this role
- ERM for CROs: how do you build the risk map, KRIs and board reporting?
- ISO 22301 for CROs: how do scenarios, RTOs and exercises enter the risk report?
- ISO 37001 for CROs: how do you manage bribery scenarios and overseas exposure?
- Trade secrets for CROs: how do you set leak scenarios, reasonable measures and KRIs?
- ISO 27001 for CROs: how do information and enterprise risk share one scale?
- AI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- GDPR for CROs: how to assess fines, intra-group transfers and breach scenarios?
- NIS2 for CROs: how to assess scope, fines and management body duties?
- CRO and DORA: where do ICT third-party and operational resilience risks go on the risk map?
- CRO and AI transformation: putting AI risk into the risk map, KRIs and board reports