EU CRA for CTOs: what changes in development, SBOM and launch timing?

As a CTO facing the EU CRA, what do we add at which development gates?

Article 13(1), (2) and (6) of the CRA require manufacturers to design, develop and produce according to the essential requirements of Annex I Part I; to assess cybersecurity risks and take them into account in planning, design, development, production, delivery and maintenance; and to report component vulnerabilities to the component maintainer and remediate them. They fit into existing gates like this:

A Taiwanese public company's internal control already covers the R&D cycle (Article 7, item 8 of the internal control regulations), so the new requirements connect to existing control points; companies that are not public companies are not covered by those regulations and can use them voluntarily.

Launch timing: which dates and steps can hold up the R&D schedule?

• 11 September 2026: the Article 14 reporting obligations already apply, also to products placed on the market before 11 December 2027, so the reporting process must work now.
• 11 December 2027: the main obligations apply in full; products in scope placed on the market after that date need a conformity assessment and the CE marking.
• Steps that cannot be compressed: if product classification and role determination are wrong, everything after them is redone; where third-party assessment is required, the timeline depends on the notified body's schedule.
• Harmonised standards: as of August 2026, no CRA harmonised standard had been published in the Official Journal; design now against the published draft standards (such as the prEN 40000 series) and run a gap comparison once they are published.
• Radio products: (EU) 2022/30 ceases to apply from 11 December 2027, after which the cybersecurity of radio products follows the CRA, so technical documentation must switch tracks.

The service page lists no fixed number of months: the timeline depends on product type and the existing foundation, and is estimated case by case after the free mechanism diagnosis.

SBOM and open-source components: how far does R&D have to go?

• SBOM: Annex I Part II, point (1) requires an SBOM in a commonly used, machine-readable format covering at least the top-level dependencies.
• Third-party component due diligence: Article 13(5) requires due diligence when integrating third-party components, including open source; this is usually procurement or supply chain working with R&D.
• Component vulnerabilities: Article 13(6) requires the manufacturer, on finding a vulnerability in a component, to notify that component's manufacturer or maintainer.
• A scanner hit is not a conclusion: scan hits are not treated as confirmed vulnerabilities; you need traceability from product version to component, determination and treatment, with VEX or an equivalent statement explaining whether the product is affected.
• Support period: at least 5 years, during which vulnerabilities must be handled effectively in line with Annex I Part II (Article 13(8)).

Technical documentation: what does Annex VII need, and how does it stay in step with product versions?

Technical documentation is built under Article 31 and Annex VII of the CRA and mapped item by item to the Annex I essential requirements; Article 13 also requires the cybersecurity risk assessment to be documented, included in the technical documentation and updated during the support period. The CTO needs three things in place:

1. A cross-reference index linking requirements, risks, controls, tests and the technical documentation.
2. Version consistency: in sample checks, documents match the product version.
3. One set of keeping rules: technical documentation, SBOM and vulnerability handling records follow the existing rules for R&D records and document keeping.

For products also subject to the EU AI Act, the same documentation architecture can support the AI Act technical documentation, so one document satisfies both audits and the work is not duplicated.

Engineering staffing: what do R&D, the PSIRT and product management each do?

The CRA does not assign the work to a department; the obligated party is the manufacturer. Splitting the work by Articles 13 and 14:

Ultimate accountability should sit with the product business unit that decides on product design and market launch; the IT department runs the company's internal systems, and product security should not be handed to it by default. The reporting contact needs authority granted in advance, or the 24-hour early warning cannot be met.

What does R&D hand over in a customer audit? Does it differ for ODM, OEM and own brand?

Placing a product on the market under your own brand makes you the manufacturer, with the full set of obligations. For ODM and OEM work, the brand customer is the manufacturer, but the customer will ask you for evidence:

• ODM: risk assessment, technical documentation inputs, SBOM and vulnerability handling support.
• OEM: component SBOM, production-side security and component verification evidence.

The contract should state the scope, the support period and the time limits for cooperating on reporting. Note also that there is no stand-alone "CRA certificate": products in scope go through a conformity assessment, the EU declaration of conformity is signed, and then the CE marking is affixed. ISO 27001 is an organisation-level information security management standard, not a CRA harmonised standard, and IEC 62443 certification is not in itself a presumption of CRA conformity (Article 27).

How does Winners Consulting help a CTO with the EU CRA?

Winners Consulting is a consultant and does not carry out conformity assessment (Article 39(4) of the CRA bars assessment bodies from providing consultancy), and vice-president and director-level consultants personally lead the work end to end, never outsourced. As listed on the service page:

1. First determine whether the product is within the CRA, which class it falls into and which conformity assessment route applies.
2. Implement IEC 62443-4-1 secure development practices, including SBOM construction.
3. Build the Annex VII technical documentation, the vulnerability handling process and the Article 14 reporting process.
4. Provide 90 days of follow-up after go-live.

R&D can also commission the work in stages: classification and gap diagnosis, SBOM and vulnerability evidence strengthening, and integration of technical documentation with reporting operations.

Go deeper: EU CRA compliance, What a CTO builds into the R&D process, Who leads CRA, CRA timeline, Choosing a CRA consultant. Request a free mechanism diagnosis