Is my product in EU CRA scope? Which three things should a product manager decide first?
The CRA covers products with digital elements: software, hardware with firmware, and remote data processing essential to the product's functions. Decide product line by product line:
- In scope or not: for example, components of type-approved vehicles are excluded; ordinary SaaS cloud services are outside the CRA and fall under NIS2 instead.
- Which class: the class depends on the product's core function, so products in the same broad category can land in different classes; check borderline cases against the technical descriptions in Implementing Regulation (EU) 2025/2392.
- Which role: placing the product under your own brand or trademark makes you the manufacturer; for ODM and OEM work, the brand customer is the manufacturer.
One company often has several classes and roles at once, and each combination needs its own assessment route.
Can the product class delay our launch? How do we fit the assessment route into the product schedule?
Yes. The difference is whether a third party is needed:
| Product class | Assessment route |
|---|---|
| Default products | Self-assessment under internal control (module A) |
| Important products, class I | Self-assessment only when applying harmonised standards, common specifications or a European cybersecurity certification scheme; otherwise a notified body |
| Important products, class II, and critical products | Always a third-party assessment |
Where a third party is needed, the timeline depends on the notified body's schedule, which the company does not control. As of August 2026, no CRA harmonised standard had been published in the Official Journal, so class I products should put a notified body into the plan now. How long the support period is, and whether to delay a launch, are product decisions.
What should the launch review check? What product specifications and technical documents must be ready?
Make the following launch gates:
- State at launch (Annex I Part I): no known exploitable vulnerabilities, and a secure-by-default configuration.
- Vulnerability handling (Annex I Part II): an SBOM in a commonly used, machine-readable format; remediation and security updates without delay; a coordinated vulnerability disclosure policy.
- Pre-launch documents (Article 13(12)): the Article 31 technical documentation and the Article 32 conformity assessment, then the EU declaration of conformity under Article 28 and the CE marking under Article 30.
There is no stand-alone "CRA certificate"; what you can show customers is the declaration of conformity, the CE marking and the technical documentation behind them.
How long should the support period be? How do we mark it and commit to it with customers and channels?
The support period is an external commitment decided at product planning:
- Length (Article 13(8)): at least five years; where the expected use time is under five years, the expected use time. Vulnerabilities in the product and its components must be handled effectively throughout.
- Marking (Article 13(19)): the end date of the support period (at least month and year) must be clearly indicated at the time of purchase.
- Keeping updates available (Article 13(9)): each security update issued during the support period stays available for at least 10 years or the rest of the support period, whichever is longer.
- How updates are provided: free of charge, unless otherwise agreed for a tailor-made product with a business user, with instructions on the action users should take.
Vulnerability handling during the support period is a recurring yearly cost, not a one-off project.
Do products we already sell count too? When can the CRA block shipments?
Keep two dates apart:
- 11 September 2026: the Article 14 reporting obligations apply, including to products placed on the EU market before 11 December 2027. After becoming aware of an actively exploited vulnerability or a severe incident, an early warning is due within 24 hours and a notification within 72 hours, submitted through the ENISA single reporting platform.
- 11 December 2027: the other main obligations apply in full. An in-scope product that does not meet the essential cybersecurity requirements, has not completed conformity assessment or does not bear the CE marking may not be placed on the EU market; breaches of the essential requirements can be fined up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher.
For products already on the market, get the reporting process ready first; products launched after 11 December 2027 must meet every requirement.
We work as an ODM or OEM. What do we commit to the brand customer?
For ODM and OEM work the brand customer is the legal manufacturer, but it passes its evidence requests on to you:
| Business model | What customers usually ask for | What the contract must state |
|---|---|---|
| ODM (you design and build, the customer brands it) | Risk assessment, technical documentation material, SBOM and vulnerability handling support | Scope, support period and the time limits for cooperating on reporting |
| OEM (the customer designs, you build) | Component SBOMs, production security and evidence of component checks | The time limits for cooperating on reporting |
If you also sell the same product in the EU under your own brand, you are the manufacturer for that part. The higher the class of the customer's product, the more evidence it will ask you to deliver.
How does Winners Consulting help product managers with the EU CRA?
Winners Consulting determines the CRA class and supply-chain role for each product line and builds secure design, SBOM and vulnerability handling into development. The service page lists three packages that can be commissioned separately:
- Classification and gap diagnosis: the basis for scope, class and assessment route decisions
- SBOM and vulnerability evidence: traceable records from product version to component, decision and treatment
- Technical documentation and reporting integration: a technical documentation cross-reference index and reporting drill records
For products also under the EU AI Act, one technical file answers audits under both laws. Winners Consulting is a consultant and does not perform assessments; VP- and director-level consultants lead the work end to end, never outsourced. As of 2026-10, Winners has 6 EU Cyber Resilience Act (CRA) compliance engagements (names withheld under NDA).
Read more: EU CRA compliance, CRA timeline, CRA budget, Who leads CRA. Request a free mechanism diagnosis
How other roles see this service
- CEOEU CRA for the CEO: European orders, penalties and ownership. What to decide now
- CISOCISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CROEU CRA for CROs: how to handle market access risk, reporting and oversight?
- CFOCFO view of the EU CRA and EU AI Act: EU revenue risk, penalties and budgeting
- CTOEU CRA for CTOs: what changes in development, SBOM and launch timing?
Other services for this role
- EU AI Act for product managers: what must the AI in our product complete before launch?
- ISO/IEC 29147 and 30111 for product managers: what can we promise on vulnerability disclosure and fixes?
- IEC 62443-4-2 for product managers: will industrial product certification delay our launch?
- ISO/SAE 21434 for product managers: how does an automotive product pass carmaker development audits?
- ISO 42001 for product managers: how do we answer customer demands on AI product governance?
- TISAX prototype protection for product managers: will a missing label block a carmaker project?
- ISO 27701 and GDPR for product managers: which privacy work comes first when selling into each market?