Meet CRA Annex I essential requirements with evidence you can show

CRA Annex I sets the essential cybersecurity requirements of the EU Cyber Resilience Act. Part I lists security properties a product with digital elements must have, such as no known exploitable vulnerabilities, secure by default configuration, access control, encryption, data minimisation and a limited attack surface. Part II lists eight vulnerability handling obligations for manufacturers, including an SBOM, regular testing, free security updates and a coordinated vulnerability disclosure policy.

The Cyber Resilience Act has eight annexes. Annex I covers essential cybersecurity requirements, Annex II user information and instructions, Annex III important products, Annex IV critical products, Annex V the EU declaration of conformity, Annex VI the simplified declaration, Annex VII technical documentation and Annex VIII conformity assessment procedures based on modules A, B, C and H.

The Annex I essential requirements apply from 11 December 2027, when the Cyber Resilience Act applies in full. Earlier dates apply to other parts: the Article 14 obligation to report actively exploited vulnerabilities and severe incidents applies from 11 September 2026, and the rules on notification of conformity assessment bodies apply from 11 June 2026. Manufacturers should build Annex I controls into products in development now.

Annex III lists important products with digital elements, split into Class I (19 categories, such as browsers, password managers, VPNs and operating systems) and Class II (4 categories, such as firewalls and hypervisors). Annex IV lists critical products, such as smartcards and smart meter gateways. Higher classes face stricter conformity assessment, with Class II and critical products needing third-party involvement rather than self-assessment.

Annex VII requires technical documentation containing a general product description, design, development and vulnerability handling processes, a cybersecurity risk assessment, information used to set the support period, the standards or specifications applied, test reports against Annex I, and a copy of the EU declaration of conformity. The SBOM must be provided where a market surveillance authority makes a reasoned request.

Breaching the Annex I essential cybersecurity requirements, or the manufacturer obligations in Articles 13 and 14, can lead to administrative fines of up to EUR 15 million or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher. Market surveillance authorities can also require corrective action or withdrawal of non-compliant products from the EU market.

Yes, partly. ISO 27001 controls on access control, cryptography, secure development, vulnerability management and testing overlap with many Annex I requirements, so existing evidence can be reused. However, ISO 27001 certifies an organisation's management system, while the CRA regulates products, so you still need product-level risk assessments, an SBOM, a disclosure policy and Annex VII technical documentation.

The CRA Annexes are mapped in OneClickComply's control library and available on request rather than live as a standard framework today. With them enabled, Annex I requirements map to controls you may already run for ISO 27001 or SOC 2, so evidence is collected once and reused. OneClickComply helps you prepare, but conformity is declared by the manufacturer or assessed by a notified body.