E-Book23 chapters # EU Cyber Resilience Act (CRA) Handbook A Cyber Resilience Act handbook for connected products: scope, default, important and critical classes, essential requirements, SBOMs and reporting duties. The complete reference for EU Cyber Resilience Act compliance — Regulation (EU) 2024/2847's essential requirements, product classification, the software bill of materials, conformity assessment, technical documentation, and the vulnerability and incident reporting pipeline that becomes mandatory on September 11, 2026. Built for manufacturers, compliance teams, and hardware startups who need a durable desk reference, not just a video course. ## What you'll learn * Determine exactly which products count as "products with digital elements" under the CRA, including indirect connections and components sold separately * Classify any product as default, important Class I, important Class II, or critical under Annex III and Annex IV, and know what each means for assessment * Implement both halves of Annex I — secure by design and default, and full-lifecycle vulnerability handling — correctly * Build and maintain a real, automated software bill of materials your team will actually keep current * Run every manufacturer, importer, and distributor obligation under Article 13, including technical documentation and the EU declaration of conformity * Choose the right conformity assessment route and work through the current harmonised-standards gap without waiting on a publication timeline * Meet the September 2026 vulnerability and incident reporting deadlines — 24 hours, 72 hours, 14 days, one month — through ENISA's Single Reporting Platform * Understand Article 64 enforcement and penalties, and how the CRA fits alongside NIS2, RED, GDPR, and the UK's and US's parallel regimes $24.99 One-time purchase · Read in browser · No subscription * Determine exactly which products count as "products with digital elements" under the CRA, including indirect connections and components sold separately * Classify any product as default, important Class I, important Class II, or critical under Annex III and Annex IV, and know what each means for assessment * Implement both halves of Annex I — secure by design and default, and full-lifecycle vulnerability handling — correctly Buy for $24.99 Secure checkout via Paddle Not what you expected? Contact us within 14 days. This book is included free when you enroll in the full course — [$199.00 for the complete video curriculum plus this book](/courses/40-eu-cyber-resilience-act-cra-connected-products). Built from a regulatory graph already at work 2,191 users this week 658 guides 323 product types 9 markets ## Chapters Read Chapter 1 free → 1 The Big Picture The Cyber Resilience Act's reporting obligations become mandatory on September 11, 2026 — a deadline that is days away, not years away, as this book goes to … 2 The Regulatory Framework Every rule in this book traces back to Regulation (EU) 2024/2847 itself. 3 Scope: What Counts as a Product With Digital Elements Every obligation in this book flows from one prior question: is your product actually in scope. 4 Product Classification: Default, Important, and Critical Classification decides everything downstream — which conformity assessment route applies, and how much scrutiny a product receives. 5 Essential Requirements — Part I: Secure by Design & Default Annex I Part One is the engineering baseline every in-scope product has to meet before it ships, regardless of classification tier. 6 Essential Requirements — Part II: Vulnerability Handling Unlike Part One, Part Two is a standing obligation that runs for a product's entire declared support period. 7 Building a Real Software Bill of Materials The single most concrete requirement in Annex I gets its own chapter: what a software bill of materials actually has to do, and how to build one that stays c… 8 Manufacturer Obligations End to End Article 13 turns every Annex I requirement into a concrete process obligation. 9 Importer and Distributor Obligations Manufacturers aren't the only economic operators with real duties here. 10 Technical Documentation & the EU Declaration of Conformity Annex VII sets out exactly what a technical file must contain. 11 Conformity Assessment Procedures Which conformity assessment module applies — A, B plus C, or H — depends entirely on classification. 12 The Harmonised Standards Gap As of this book's writing, no CRA harmonised standard has been published in the Official Journal. 13 CE Marking for Products With Digital Elements A connected product often answers to several CE marking regulations at once. 14 Reporting Obligations: 24 Hours to One Month The chapter this book keeps circling back to. 15 Market Surveillance, Enforcement & Penalties Article 64's three-tier penalty structure, and what a realistic enforcement sequence actually looks like before it ever reaches that stage. 16 Free and Open-Source Software Under the CRA A distinct, lighter regime for open-source software stewards — and a reminder that it never transfers a manufacturer's own due diligence duty onto someone else. 17 How the CRA Fits With Other Regimes NIS2, GDPR, the Radio Equipment Directive, the Machinery Regulation, and — for any multi-market manufacturer — the UK's PSTI Act and Cyber Security and Resil… 18 Full Walkthrough: Building a Compliance Program Halyard Sensing is a composite case study, built from real patterns, walking every system in this book through one realistic manufacturer building a complian… 19 Common Mistakes & Edge Cases Every mistake catalogued in this chapter traces back to a system covered earlier in the book — the argument for treating compliance as one integrated, living… 20 Your Compliance Action Plan The closing chapter turns everything in this book into a concrete thirty, sixty, ninety-day plan, and an honest look at what comes after it. 21 Knowledge Checks Every knowledge check from the course, collected here for quick self-testing. 22 Appendix A: Classification, SBOM, and Documentation Tools 23 Appendix B: Assessment, Reporting, and Cross-Market Tools Buy for $24.99 ## Want the full video course? This book's companion course covers the same material with video lessons and downloadable resources — and includes this book free. [ ![EU Cyber Resilience Act (CRA) Compliance Course](/posters/40-eu-cyber-resilience-act-cra-connected-products.svg) ](/courses/40-eu-cyber-resilience-act-cra-connected-products) Intermediate2h 21m [ ### EU Cyber Resilience Act (CRA) Compliance Course ](/courses/40-eu-cyber-resilience-act-cra-connected-products) EU Cyber Resilience Act compliance: product classes, essential requirements, SBOMs, vulnerability handling and the September 2026 reporting duty. Includes the ebook, free $199.00[View course →](/courses/40-eu-cyber-resilience-act-cra-connected-products) Need more than one? The **All-Access Krono Vault** unlocks every course and book for one payment, or put your whole team on it with **Krono Team Vault**. [See pricing](/pricing) Short on time? ### Rather hand it over than learn it? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. [See services](/services)