Cyber Resilience Act decision examples
CRA essential requirements
Find gaps in product-security controls and the evidence needed for review. Compare worked examples and the evidence behind each CRA assessment.
What is missing from the readiness record?
Open a situation to compare the relevant facts, worked results and evidence to retain.
What evidence supports CRA secure-by-default readiness?
The readiness record should demonstrate the shipped configuration and its security behaviour. A policy saying that defaults are secure is not evidence that the release implements them.
View facts and examplesHow should CRA readiness cover security-update delivery?
The update process needs evidence of secure distribution and the applicable delivery conditions. A working download button alone does not establish readiness.
View facts and examplesHow to use these examples
The situations are hypothetical and use explicitly recorded assumptions. They explain a decision path, not a conclusion about your own product. Reporting obligations for manufacturers apply from 11 September 2026; broader product requirements apply from 11 December 2027.
Product-readiness examples support preparation for those broader requirements. A readiness result does not declare conformity. Primary sources and the assessment version are provided on each situation page.