How long must the EU CRA support period be?

Under Article 13(8), at least five years; where the product is expected to be in use for less than five years, the expected use time. Vulnerabilities in the product and its components must be handled effectively throughout the support period.

What documents does the CRA require before launch?

Under Article 13(12), the Article 31 technical documentation and the Article 32 conformity assessment procedure; then the EU declaration of conformity under Article 28 and the CE marking under Article 30.

What does the CRA require about vulnerabilities at launch?

Annex I Part I requires products to be placed on the market without known exploitable vulnerabilities and with a secure-by-default configuration; Part II requires an SBOM in a commonly used, machine-readable format, remediation without delay through security updates, and a coordinated vulnerability disclosure policy.

When does the CRA start to apply?

The Article 14 reporting obligations apply from 11 September 2026 and cover products already on the EU market; the other main obligations apply in full from 11 December 2027.

Our product contains high-risk AI. What must the provider do?

Under Article 16 of the EU AI Act, the provider must meet the Section 2 requirements, run a quality management system under Article 17, complete the Article 43 conformity assessment before launch, draw up the EU declaration of conformity, affix the CE marking and register under Article 49(1).

Does IEC 62443 certification mean CRA conformity?

No. IEC 62443 certification does not create a CRA presumption of conformity; that comes only from harmonised standards published in the Official Journal, common specifications or designated certification schemes (CRA Article 27).

What must a product manager confirm before launch? 7 requirements explained one by one

Direct answer: the product manager has to confirm, inside the development schedule, which laws each product line must meet, which assessment route it takes and which documents must be ready before launch. For products entering the EU, Article 13 of the EU CRA requires manufacturers to complete the technical documentation and conformity assessment before placing the product on the market, then draw up the EU declaration of conformity and affix the CE marking; at launch the product must have no known exploitable vulnerabilities and a secure-by-default configuration; and vulnerabilities must be handled effectively throughout the support period, which is at least five years, or the expected use time if shorter. Where the product contains high-risk AI, Article 16 of the EU AI Act requires the provider to run a quality management system, complete conformity assessment, draw up a declaration of conformity, affix the CE marking and register. Own-brand, ODM and OEM roles carry different obligations, so clarify the role first.

What to confirm before launch (EU CRA)

Decision	Key wording	What the product manager does
Product category and assessment route	Default products can use internal control (module A); important class I products without full use of harmonised standards, class II and critical products need a third-party procedure	Classify each product line and put it in the schedule
Support period (Article 13(8))	At least five years; where the expected use time is under five years, the expected use time	Set the support period at planning time and fund security updates to match
State at launch (Annex I Part I)	No known exploitable vulnerabilities; secure-by-default configuration	Make vulnerability scanning and a default-settings review a launch gate
Vulnerability handling (Annex I Part II)	An SBOM in a commonly used, machine-readable format; remediation without delay through security updates; a coordinated vulnerability disclosure policy	Ship the SBOM and the security update mechanism with the product
Pre-launch documents (Article 13(12))	Draw up the Article 31 technical documentation and carry out the Article 32 conformity assessment, then draw up the EU declaration of conformity under Article 28 and affix the CE marking under Article 30	Make the technical documentation and assessment launch milestones
Timing	Article 14 reporting obligations apply from 11 September 2026; the other main obligations apply in full from 11 December 2027	Products launched after 11 December 2027 must meet all requirements

Requirement by requirement: what the product manager decides, what to finish before launch, how long it takes

EU Cyber Resilience Act (CRA)

Decide first: whether the product is in CRA scope (for example, type-approved vehicle components are excluded), which category it falls into, and the company's role: own brand, ODM or OEM.
Finish before launch: the Annex VII technical documentation, conformity assessment, EU declaration of conformity and CE marking; the vulnerability handling process and SBOM.
Timeline: depends on product category and existing foundations; an estimate follows the free diagnosis.
Go deeper: EU CRA compliance, CRA timeline, CRA budget, Who leads CRA

EU AI Act

Decide first: the role (provider or deployer) and risk tier of each AI system in the product under the EU AI Act.
What a high-risk AI provider does (Article 16): meet the Section 2 requirements; run a quality management system under Article 17; complete the Article 43 conformity assessment before launch; draw up the EU declaration of conformity; affix the CE marking; register under Article 49(1).
Timeline (as listed on the service page): high-risk AI compliance usually 6–9 months, 9–12 months together with ISO 42001 certification.
Go deeper: EU AI Act, Choosing an EU AI Act consultant

ISO/IEC 29147 and 30111 vulnerability disclosure and handling

What it means for the product manager: the CRA requires outcomes: a coordinated vulnerability disclosure policy, a contact address for reports, remediation, and public information on fixed vulnerabilities once a security update is available. 29147 covers receiving reports and publishing advisories; 30111 covers internal verification, rating and remediation.
Typical deliverables: security.txt and a reporting mailbox or form, intake and response SLAs, a CVD policy, advisory templates and a publishing process.
Go deeper: ISO/IEC 29147, ISO/IEC 30111

IEC 62443-4-2 industrial control products

What it means for the product manager: technical security requirements for industrial control and OT products; before a 4-2 product certification, the organisation must complete 4-1 SDL certification. IEC 62443 certification is not a presumption of CRA conformity.
Timeline (as listed on the service page): 4-2 product certification 4–8 months (excluding 4-1).
Go deeper: IEC 62443

ISO/SAE 21434 automotive products

What it means for the product manager: it covers the whole lifecycle of vehicle E/E systems, from concept and development to production, operation, maintenance and decommissioning; the standard itself has no official certification scheme, and what matters more is passing the carmaker's development audits.
Go deeper: ISO/SAE 21434

ISO 42001 AI management system

What it means for the product manager: when customers want proof of how an AI product is governed, ISO 42001 is a certifiable management system standard; but a certificate cannot replace EU AI Act conformity assessment, EU database registration, an authorised representative or Article 50 transparency.
Timeline (as listed on the service page): usually 4–6 months with ISO 27001 in place; about 6–9 months from scratch.
Go deeper: ISO 42001

TISAX prototype protection

What it means for the product manager: when a carmaker hands prototypes to a supplier, it may require a TISAX assessment scope that includes prototype protection; assessments commissioned from 1 January 2027 use VDA ISA2027.
Go deeper: TISAX assessment consulting, TISAX timeline

How it fits the systems you already have

Product development already has milestones and a launch review; the new requirements belong in those existing gates, not in a separate process.

Existing gate	How the new requirements fold in
Product planning and approval	Determine the CRA category and assessment route and the AI system risk tier; set the support period
Design review	Risk assessment against the CRA Annex I essential requirements; TARA for automotive products
Launch review	No known exploitable vulnerabilities, secure defaults, SBOM, technical documentation, declaration of conformity and CE marking
Post-launch maintenance	Vulnerability handling and security updates, coordinated vulnerability disclosure, CRA Article 14 reporting

How Winners Consulting works

This is Winners Consulting's own description; hold us to the questions above, just as you would any other consultant.

Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced
By product line: we determine the CRA class and supply-chain role per product line and build secure design, SBOM and vulnerability handling into development
One technical file: one document system built on the common requirements of the CRA, NIS2 and the EU AI Act; for products also under the EU AI Act, one technical file answers audits under both laws
First step: the first mechanism diagnosis is free

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.