Skip to the text
headlesslaw
Search or jump to a citation
/
Definitions
CRA · contents
Recitals
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
Chapter I — General provisions
1
Subject matter
2
Scope
3
Definitions
Chapter II — Obligations of economic operators and provisions in relation to free and open-source software
4
Free movement
5
Procurement or use of products with digital elements
6
Requirements for products with digital elements
7
Important products with digital elements
8
Critical products with digital elements
9
Stakeholder consultation
10
Enhancing skills in a cyber resilient digital environment
11
General product safety
12
High-risk AI systems
13
Obligations of manufacturers
14
Reporting obligations of manufacturers
15
Voluntary reporting
16
Establishment of a single reporting platform
17
Other provisions related to reporting
18
Authorised representatives
19
Obligations of importers
20
Obligations of distributors
21
Cases in which obligations of manufacturers apply to importers and distributors
22
Other cases in which obligations of manufacturers apply
23
Identification of economic operators
24
Obligations of open-source software stewards
25
Security attestation of free and open-source software
26
Guidance
Chapter III — Conformity of the product with digital elements
27
Presumption of conformity
28
EU declaration of conformity
29
General principles of the CE marking
30
Rules and conditions for affixing the CE marking
31
Technical documentation
32
Conformity assessment procedures for products with digital elements
33
Support measures for microenterprises and small and medium-sized enterprises, including start-ups
34
Mutual recognition agreements
Chapter IV — Notification of conformity assessment bodies
35
Notification
36
Notifying authorities
37
Requirements relating to notifying authorities
38
Information obligation on notifying authorities
39
Requirements relating to notified bodies
40
Presumption of conformity of notified bodies
41
Subsidiaries of and subcontracting by notified bodies
42
Application for notification
43
Notification procedure
44
Identification numbers and lists of notified bodies
45
Changes to notifications
46
Challenge of the competence of notified bodies
47
Operational obligations of notified bodies
48
Appeal against decisions of notified bodies
49
Information obligation on notified bodies
50
Exchange of experience
51
Coordination of notified bodies
Chapter V — Market surveillance and enforcement
52
Market surveillance and control of products with digital elements in the Union market
53
Access to data and documentation
54
Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk
55
Union safeguard procedure
56
Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk
57
Compliant products with digital elements which present a significant cybersecurity risk
58
Formal non-compliance
59
Joint activities of market surveillance authorities
60
Sweeps
Chapter VI — Delegated powers and committee procedure
61
Exercise of the delegation
62
Committee procedure
Chapter VII — Confidentiality and penalties
63
Confidentiality
64
Penalties
65
Representative actions
Chapter VIII — Transitional and final provisions
66
Amendment to Regulation (EU) 2019/1020
67
Amendment to Directive (EU) 2020/1828
68
Amendment to Regulation (EU) No 168/2013
69
Transitional provisions
70
Evaluation and review
71
Entry into force and application
Annexes
I
ESSENTIAL CYBERSECURITY REQUIREMENTS
II
INFORMATION AND INSTRUCTIONS TO THE USER
III
IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS
IV
CRITICAL PRODUCTS WITH DIGITAL ELEMENTS
V
EU DECLARATION OF CONFORMITY
VI
SIMPLIFIED EU DECLARATION OF CONFORMITY
VII
CONTENT OF THE TECHNICAL DOCUMENTATION
VIII
CONFORMITY ASSESSMENT PROCEDURES
Guidelines
Digital & data
Level 3
CRA
Guidelines under CRA, ordered by official identifier.
C(2026) 5252
Guideline — Application of the Cyber Resilience Act
Stage:
Draft