Compliance
Assessment, documentation and reporting for product and compliance leads.
3 modules · 10 lessons · 82 min
Foundations
Everything every role must know: what the CRA is, who it binds, and when.
What the CRA is and why it exists
The first horizontal cybersecurity law for products with digital elements, and the market failure it targets.
Scope: products with digital elements and the risk classes
What counts as a product with digital elements, what is carved out, and how important/critical classification changes your workload.
Key dates and the transition timeline
What is already binding, what lands in September 2026, and what December 2027 means for products in development today.
Roles: manufacturer, importer, distributor, open-source steward
Who carries which duty in the supply chain, and how a role can change under your feet.
Conformity & Documentation
Proving compliance: assessment routes, technical documentation, standards, CE marking.
Conformity assessment routes and modules
Choosing between self-assessment, type examination and full quality assurance.
Technical documentation (Annex VII) in practice
Assembling the file, and how to write it so it stays current across releases.
Harmonised standards and presumption of conformity
How standards reduce your burden, and what to do while they are still being written.
Reporting & Ongoing Obligations
Life after placing on the market: reporting, surveillance, penalties, suppliers.
Reporting exploited vulnerabilities and severe incidents
The 24 / 72 hour / 14 day clocks, who you notify, and how to be ready before the clock starts.
CE marking, declaration of conformity and market surveillance
Closing the loop: what you sign, what you affix, and what happens when an authority calls.
Support period, suppliers and contracts
Turning a decade-long legal commitment into supplier terms you can actually enforce.