Question 1

Is this legal advice?

Accepted Answer

No. PartsProof is a documentation and readiness service. We build your process artifacts from the regulation’s published text and ENISA guidance. For legal questions about your specific exposure, talk to counsel — our scope memo gives them a running start.

Question 2

Does this make my product CE-compliant?

Accepted Answer

No, and be wary of anyone who says a document pack can. Full conformity (Annex I, CE marking) lands December 11, 2027 and involves real security engineering. This pack covers the September 11, 2026 reporting obligations completely, and the included gap checklist shows exactly what 2027 will ask of you.

Question 3

I already sell in the EU. Does the deadline still apply to me?

Accepted Answer

Yes. Article 14 applies from September 11, 2026 to every in-scope product, including ones placed on the market before then, and the duty outlives the support period. It is not retroactive reporting, though: Commission guidance of July 27, 2026 confirms you owe nothing for exploitation you had already become aware of before that date. The clock runs on what you learn from September 11 onward.

Question 4

What exactly do I have to report?

Accepted Answer

Two things: actively exploited vulnerabilities in your product, and severe incidents affecting its security. Each triggers the cascade — early warning in 24 hours, notification in 72, final report in 14 days (vulnerabilities) or a month (incidents) — filed once through the CRA Single Reporting Platform, addressed to the CSIRT where you have your main establishment. The runbook walks each step with the forms pre-drafted.

Question 5

What’s an SBOM and why do I need one?

Accepted Answer

A software bill of materials — a machine-readable list of every component and dependency in your product. It’s how you answer “are we affected?” in minutes instead of days when a dependency CVE drops, and it’s expected under the CRA’s vulnerability-handling requirements.

Question 6

My product is mostly open source. Am I exempt?

Accepted Answer

Only if it’s outside commercial activity. The moment you charge for the product, support, or hosting, you’re a manufacturer under the CRA. Open-source stewards get a lighter regime — the scope checker walks that edge case.

Get in touch