Outcome-led CRA guides

Finish the CRA work
in front of you.

Make a product decision, rehearse a reporting handoff or decide which tools are worth paying for. Pick the guide for the job you need to finish.

An older charcoal sensor in an open archival box beside a fresh blue reporting folder

Reporting decision

Does CRA reporting apply to products sold before 11 December 2027?

Yes. CRA Article 14 reporting applies from 11 September 2026 to in-scope older products. Article 69(3) preserves that duty during the transition.

13 September 2026 4 min read

Read the article

Choose the next outcome

One job at a time.

Reporting rehearsal

Before 11 September: run a 45-minute CRA reporting drill

Test the handoff from a vulnerability signal to a prepared early warning. Leave with a named backup, checked deadlines and a short list of gaps to fix.

Buying guide

CRA compliance software: what to test before you buy

Decide whether a spreadsheet, your existing ticketing system or CRA Operations fits the work. Test one case, one handoff and the evidence before paying.

Support-period decision

CRA support periods: how to choose an end date you can defend

Work out a product’s expected use, check component support and record a justified security-support end date instead of defaulting to five years.

Reporting decision

How to decide whether a CRA vulnerability needs reporting

Turn the first vulnerability signal into a recorded CRA reporting route, with the affected product, awareness time, owner and deadlines kept together.