The CRA, requirement by requirement

What the CRA asks

Early warning within 24 hours of becoming aware, notification within 72 hours and a final report within 14 days after a corrective measure is available, via the ENISA single reporting platform.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableReport preparation from a human determination, with early-warning, notification and final-report deadlines, and receipts recorded after a person submits.
• AvailableA finding flagged exploited in the wild prompts a possible reporting assessment; a person decides, and nothing is reported automatically.
• AvailableVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.

What the CRA asks

Early warning within 24 hours, notification within 72 hours and a final report within one month of the notification.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableReport preparation from a human determination, with early-warning, notification and final-report deadlines, and receipts recorded after a person submits.
• AvailableVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.

What the CRA asks

Inform impacted users about an actively exploited vulnerability or severe incident and, where needed, about mitigations they can apply.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableReport preparation from a human determination, with early-warning, notification and final-report deadlines, and receipts recorded after a person submits.

What the CRA asks

Design, develop and produce the product according to the essential cybersecurity requirements, based on a documented cybersecurity risk assessment that is kept up to date.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableObligation tracking with recorded applicability decisions and independently reviewed evidence.
• In developmentGuided cybersecurity risk-assessment template.

What the CRA asks

Exercise due diligence when integrating third-party components, including open-source software, so they do not compromise the product's cybersecurity.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableSBOM import and explainable advisory matching for every third-party component.
• AvailableOn-demand SBOM import per release from GitHub: the SBOM attached to the GitHub release (exact), otherwise the repository dependency graph, marked partial when the default branch is not the tagged commit. The access token is used for that one import and never stored.
• In developmentAutomatic import when a release is published on GitHub.

What the CRA asks

Identify and document vulnerabilities and components, including a software bill of materials in a commonly used, machine-readable format covering at least top-level dependencies.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableCycloneDX JSON SBOM import per release, with source hash and import history, including failed imports.
• AvailableOn-demand SBOM import per release from GitHub: the SBOM attached to the GitHub release (exact), otherwise the repository dependency graph, marked partial when the default branch is not the tagged commit. The access token is used for that one import and never stored.
• AvailableVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.
• In developmentAutomatic import when a release is published on GitHub.

What the CRA asks

Address and remediate vulnerabilities without delay, including through security updates, and test and review the product's security regularly.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableTriage with separate severity, exposure and exploitation; retest evidence, independent review, and reassessment when an advisory or component changes.
• AvailableExploited-vulnerability feeds (CISA KEV and the ENISA EU Vulnerability Database, unofficial format), uploaded as files or refreshed live when enabled, linked to your advisories by CVE or GHSA id: matching findings are flagged exploited in the wild.
• AvailableGuided exploitation checks per finding (npm, PyPI, generic, container images): read-only commands you copy and run yourself, never run by ProveStack, with outcomes recorded as evidence for review.
• AvailableVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.

What the CRA asks

Put in place and enforce a coordinated vulnerability disclosure policy and a contact address for reporting vulnerabilities.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableCoordinated vulnerability disclosure policy and security contact templates, with an RFC 9116 security.txt file: questionnaire, deterministic draft, editing, independent approval, then linked as evidence. Template wording pending legal review.

What the CRA asks

Provide security updates securely, free of charge where required, with advisory information for users, and publicly disclose fixed vulnerabilities.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableRecord and review evidence of how a security update reached users.
• AvailableVulnerability handling policy template: questionnaire, deterministic draft, editing, independent approval, then linked as evidence to this obligation. Template wording pending legal review.
• PlannedSecurity advisory publication helper.

What the CRA asks

Determine a support period reflecting the expected use time (generally at least five years unless the product is expected to be used for less) and handle vulnerabilities throughout it.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableReleases with a support end date, so the support period you publish has a source.
• AvailableSupport period statement template drafted from your releases' support end dates, approved by a second person and linked as evidence. Template wording pending legal review.

What the CRA asks

Draw up technical documentation before placing the product on the market and keep it up to date.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableEvidence packet export: frozen product state, provenance, journal and unresolved items, identified by a SHA-256 manifest.
• PlannedTechnical documentation assembly.

What the CRA asks

Provide users with the required information and instructions, including the support period end and the contact point for vulnerability reporting.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableSecurity contact (with security.txt) and support period statement templates, for the contact and support information users need. Template wording pending legal review.
• PlannedUser information and instructions template.

What the CRA asks

Carry out the applicable conformity assessment procedure for the product's category, draw up the EU declaration of conformity and affix the CE marking. ProveStack does not perform or grant this.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableReadiness tracking and reviewed evidence to prepare your conformity assessment.

Tracking only: ProveStack does not perform conformity assessment or grant CE marking.

What the CRA asks

Place on the market only products whose manufacturer has carried out the conformity assessment, drawn up technical documentation and affixed the CE marking.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableRole-based applicability decisions and evidence of the checks made before placing the product on the market.

What the CRA asks

Act with due care, verifying the CE marking and that manufacturer and importer obligations were met before making the product available.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableRole-based applicability decisions and evidence of your due-care checks.

What the CRA asks

Put in place and document a cybersecurity policy fostering secure development and effective vulnerability handling, and cooperate with market surveillance authorities.

Paraphrase, not legal text; pending legal review.

How ProveStack helps

• AvailableRole-based applicability decisions and evidence for your documented cybersecurity policy.