Compliance Colleague · Standards · EU & UK

EU Cyber Resilience Act (Regulation (EU) 2024/2847): cited answers and gap reviews

An AI compliance assistant for makers and sellers of products with digital elements · updated 2026-10-03

The Cyber Resilience Act sets cybersecurity and vulnerability-handling requirements for products with digital elements sold in the EU. Compliance Colleague covers product classification, conformity assessment, SBOMs and reporting duties for manufacturers, importers and distributors.

Try it on your own EU Cyber Resilience Act work: one document review or two questions, free for 30 days, no card required. Start free →

What it covers

Product classification: default, Class I and Class II
Annex I essential requirements and conformity assessment routes
SBOMs, support periods and CE marking
Vulnerability and incident reporting to ENISA and CSIRTs
Manufacturer, importer and distributor duties

Questions you can ask

“Is our product Class I or Class II?”
“What must we report to ENISA, and how fast?”
“How long does our support period have to be?”

Every answer cites the EU Cyber Resilience Act requirement, article or control it rests on, so you can check it in seconds.

What you can upload for review

A vulnerability handling policy checked against Annex I
An SBOM process description checked for gaps
A product architecture diagram checked for security-relevant interfaces

Files: PDF, Word, Excel or CSV, Visio (.vsdx), draw.io, or an image such as a screenshot. Choose a full review, a prioritized fix list (each gap with its fix and the evidence an assessor will expect) or a short summary, and download the result as Word or PDF.

Crosswalk EU Cyber Resilience Act to other standards

With EU Cyber Resilience Act in your plan you can compare it against any standard in the library and see where they align and exactly where they don’t. Common pairings:

Upcoming EU Cyber Resilience Act dates

December 11, 2027

EU Cyber Resilience Act applies in full

Source: Regulation (EU) 2024/2847 Art. 71(2)

Add every compliance deadline to your calendar, free →

What it’s built from

Compliance Colleague carries the official text and checks its answers against it: Regulation (EU) 2024/2847 (Cyber Resilience Act) (Publications Office of the European Union (EUR-Lex)).

Re-checked every month for new versions, deadlines and penalty changes. Full list on the sources page.

More EU & UK standards

GDPR · EU AI Act · NIS2 · DORA · CSRD

Compliance Colleague covers 30+ security, privacy and AI governance standards. It reviews policies, spreadsheets and diagrams and answers questions with the clause cited; your judgment and sign-off stay with you. Try it free, no card required →

Research aid, not legal or audit advice, and not an audit opinion or certification. Verify findings against the official text before relying on them.