CRA glossary

For a device maker

A vulnerability for which reliable evidence shows that a malicious actor has exploited it in a system without the owner's permission; the trigger of the reporting duty of Art. 14(1). A listing or a finding is a signal; whether reliable evidence exists is assessed by the manufacturer.

Definition · Art. 3(42) on EUR-Lex

‘actively exploited vulnerability’ means a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner;

For a device maker

A person or company established in the Union that holds a written mandate from the manufacturer to carry out specified tasks on its behalf.

Definition · Art. 3(15) on EUR-Lex

‘authorised representative’ means a natural or legal person established within the Union who has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks;

For a device maker

The mark by which the manufacturer indicates that the device and the manufacturer's processes conform to Annex I and to the other Union harmonisation legislation that provides for the mark.

Definition · Art. 3(31) on EUR-Lex

‘CE marking’ means a marking by which a manufacturer indicates that a product with digital elements and the processes put in place by the manufacturer are in conformity with the essential cybersecurity requirements set out in Annex I and other applicable Union harmonisation legislation providing for its affixing;

For a device maker

Class I of Annex III names, among 19 items, network interfaces, operating systems, routers and modems, microprocessors and microcontrollers with security-related functionalities and smart home products with security functionalities; Art. 32(2) sets their assessment route.

Excerpt · Annex III, Class I on EUR-Lex

10. Physical and virtual network interfaces
11. Operating systems
12. Routers, modems intended for the connection to the internet, and switches
13. Microprocessors with security-related functionalities
14. Microcontrollers with security-related functionalities
15. Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities [...]
17. Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems

For a device maker

Class II of Annex III names hypervisors and container runtimes, firewalls and intrusion detection or prevention systems, and tamper-resistant microprocessors and microcontrollers; Art. 32(3) sets their assessment route, without the internal control option.

Excerpt · Annex III, Class II on EUR-Lex

1. Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments
2. Firewalls, intrusion detection and prevention systems
3. Tamper-resistant microprocessors
4. Tamper-resistant microcontrollers

For a device maker

Software or hardware meant to be built into an electronic information system: a radio module, a chipset with its firmware, a library in the firmware image.

Definition · Art. 3(6) on EUR-Lex

‘component’ means software or hardware intended for integration into an electronic information system;

For a device maker

The process of verifying that the device meets the essential cybersecurity requirements of Annex I (Art. 32); mandatory CRA conformity assessment applies from 11 December 2027.

Definition · Art. 3(27) on EUR-Lex

‘conformity assessment’ means the process of verifying whether the essential cybersecurity requirements set out in Annex I have been fulfilled;

For a device maker

Annex IV lists three categories: hardware devices with security boxes, smart meter gateways and other devices for advanced security purposes, and smartcards or similar devices including secure elements; Art. 8 lets the Commission require a European cybersecurity certificate for them.

Excerpt · Art. 8(1)-(2); Annex IV on EUR-Lex

1. Hardware Devices with Security Boxes
2. Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council (1) and other devices for advanced security purposes, including for secure cryptoprocessing
3. Smartcards or similar devices, including secure elements

For a device maker

The national CSIRT that, together with ENISA, receives the manufacturer's Art. 14 notifications; Art. 14(7) says which Member State's CSIRT it is.

Definition · Art. 3(51); Art. 14(1), (7) on EUR-Lex

‘CSIRT designated as coordinator’ means a CSIRT designated as coordinator pursuant to Article 12(1) of Directive (EU) 2022/2555.

For a device maker

The potential loss or disruption from an incident, expressed as the combination of its magnitude and its likelihood; the basis of the risk assessment of Art. 13(2).

Definition · Art. 3(37) on EUR-Lex

‘cybersecurity risk’ means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident;

For a device maker

A reseller or wholesaler in the supply chain that makes the device available without changing its properties; neither the manufacturer nor the importer.

Definition · Art. 3(17) on EUR-Lex

‘distributor’ means a natural or legal person in the supply chain, other than the manufacturer or the importer, that makes a product with digital elements available on the Union market without affecting its properties;

For a device maker

The first notification, within 24 hours of the manufacturer becoming aware of an actively exploited vulnerability or a severe incident, naming where applicable the Member States in which the device has been made available.

Provision · Art. 14(2)(a); for incidents Art. 14(4)(a) on EUR-Lex

an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, indicating, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available;

For a device maker

Annex I in two parts: Part I, the properties of the device itself, such as a secure by default configuration and the protection of stored and transmitted data; Part II, how the manufacturer handles vulnerabilities, including the software bill of materials and security updates.

Provision · Annex I (Part I and Part II); Art. 3(27); Art. 13(1), (8) on EUR-Lex

Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks.

For a device maker

The document the manufacturer draws up under Art. 13(12) stating that the applicable Annex I requirements have been demonstrated; the model is in Annex V.

Provision · Art. 28(1); Art. 13(12), (20); Annex V (model), Annex VI (simplified) on EUR-Lex

The EU declaration of conformity shall be drawn up by manufacturers in accordance with Article 13(12) and state that the fulfilment of the applicable essential cybersecurity requirements set out in Annex I has been demonstrated.

For a device maker

A vulnerability that an adversary could effectively use under practical operating conditions; Annex I Part I(2)(a) requires devices to be made available without known exploitable vulnerabilities.

Definition · Art. 3(41) on EUR-Lex

‘exploitable vulnerability’ means a vulnerability that has the potential to be effectively used by an adversary under practical operational conditions;

For a device maker

Due no later than 14 days after a corrective or mitigating measure is available for a vulnerability, and within one month after the incident notification for a severe incident.

Provision · Art. 14(2)(c) (vulnerabilities); Art. 14(4)(c) (incidents) on EUR-Lex

unless the relevant information has already been provided, a final report, no later than 14 days after a corrective or mitigating measure is available, including at least the following: (i) a description of the vulnerability, including its severity and impact; (ii) where available, information concerning any malicious actor that has exploited or that is exploiting the vulnerability; (iii) details about the security update or other corrective measures that have been made available to remedy the vulnerability.

For a device maker

A standard under Regulation (EU) No 1025/2012; applying one gives a presumption of conformity for the requirements it covers (Art. 27(1)).

Definition · Art. 3(36) on EUR-Lex

‘harmonised standard’ means a harmonised standard as defined in Article 2, point (1)(c), of Regulation (EU) No 1025/2012;

For a device maker

A product whose core functionality is one of the Annex III categories, such as a router or a microcontroller with security-related functionalities; it follows the conformity assessment procedures of Art. 32(2) and (3). Art. 7 ties the status to the product's own core functionality.

Provision · Art. 7(1)-(2); Annex III (Class I and Class II) on EUR-Lex

Products with digital elements which have the core functionality of a product category set out in Annex III shall be considered to be important products with digital elements and shall be subject to the conformity assessment procedures referred to in Article 32(2) and (3).

For a device maker

A person or company established in the Union that places on the Union market a device bearing the name or trademark of a manufacturer established outside the Union.

Definition · Art. 3(16) on EUR-Lex

‘importer’ means a natural or legal person established in the Union who places on the market a product with digital elements that bears the name or trademark of a natural or legal person established outside the Union;

For a device maker

An incident that affects, or can affect, the device's ability to protect the availability, authenticity, integrity or confidentiality of data or functions; only the severe subset is reportable under Art. 14(3).

Definition · Art. 3(44); Art. 14(3), (5) on EUR-Lex

‘incident having an impact on the security of the product with digital elements’ means an incident that negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of data or functions;

For a device maker

The Annex II information that accompanies the device on paper or electronically, including the single point of contact, the end date of the support period and, if the manufacturer makes the software bill of materials available, where to find it.

Provision · Annex II; Art. 13(18) on EUR-Lex

Manufacturers shall ensure that products with digital elements are accompanied by the information and instructions to the user set out in Annex II, in paper or electronic form.

For a device maker

The use the manufacturer states in the instructions, the sales material and the technical documentation, including the context and conditions of use.

Definition · Art. 3(23) on EUR-Lex

‘intended purpose’ means the use for which a product with digital elements is intended by the manufacturer, including the specific context and conditions of use, as specified in the information supplied by the manufacturer in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation;

For a device maker

Any supply of a device for distribution or use on the Union market in the course of a commercial activity, paid or free of charge.

Definition · Art. 3(22) on EUR-Lex

‘making available on the market’ means the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge;

For a device maker

Whoever places the device on the market under its own name or trademark (Art. 3(13)), even if others designed or produced it; a design house usually is not the manufacturer.

Definition · Art. 3(13) on EUR-Lex

‘manufacturer’ means a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge;

For a device maker

A conformity assessment body notified under Chapter IV; bodies can be notified from 11 June 2026, and mandatory CRA conformity assessment applies from 11 December 2027.

Definition · Art. 3(29) on EUR-Lex

‘notified body’ means a conformity assessment body designated in accordance with Article 43 and other relevant Union harmonisation legislation;

For a device maker

The first making available of a product on the Union market, as distinct from making available, which covers every later supply.

Definition · Art. 3(21) on EUR-Lex

‘placing on the market’ means the first making available of a product with digital elements on the Union market;

For a device maker

A policy the manufacturer puts in place and enforces for the coordinated disclosure of vulnerabilities (Annex I Part II(5)); Part II(6) adds a contact address for reporting vulnerabilities.

Provision · Annex I Part II(5); Art. 13(8) last subparagraph; Annex VII point 2(b); recital 76 on EUR-Lex

put in place and enforce a policy on coordinated vulnerability disclosure;

For a device maker

A connected device together with the remote data processing it needs to work; a module or a firmware component sold separately is a product of its own.

Definition · Art. 3(1) on EUR-Lex

‘product with digital elements’ means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately;

For a device maker

The server side that the manufacturer designed, or had designed under its responsibility, when a function of the device would fail without it.

Definition · Art. 3(2) on EUR-Lex

‘remote data processing’ means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions;

For a device maker

The device is made available with a secure configuration out of the box and can be reset to its original state; a different configuration may be agreed with a business user for a tailor-made product (Annex I Part I(2)(b)).

Provision · Annex I Part I(2)(b) on EUR-Lex

be made available on the market with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made product with digital elements, including the possibility to reset the product to its original state;

For a device maker

A firmware or software update that addresses an identified security issue; Annex I Part II(8) requires it to be disseminated without delay and, apart from agreed tailor-made products, free of charge, with an advisory message.

Provision · Annex I Part II(2) and (8); Art. 13(9) on EUR-Lex

ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made product with digital elements, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken.

For a device maker

An incident that affects, or can affect, the device's ability to protect sensitive or important data or functions, or that has led or can lead to malicious code being introduced or executed; Art. 14(5) sets the test, and only severe incidents are reportable under Art. 14(3).

Provision · Art. 14(3), (5) on EUR-Lex

For the purposes of paragraph 3, an incident having an impact on the security of the product with digital elements shall be considered to be severe where: (a) it negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions; or (b) it has led or is capable of leading to the introduction or execution of malicious code in a product with digital elements or in the network and information systems of a user of the product with digital elements.

For a device maker

The manufacturer's own contact that lets users reach it directly and quickly, including to report vulnerabilities of the device; it is named in the Annex II information. Not the ENISA reporting platform.

Provision · Art. 13(17); Annex II on EUR-Lex

For the purposes of this Regulation, manufacturers shall designate a single point of contact to enable users to communicate directly and rapidly with them, including in order to facilitate reporting on vulnerabilities of the product with digital elements.

For a device maker

The platform set up and run by ENISA through which the Art. 14 notifications reach the CSIRT designated as coordinator and ENISA at the same time (Art. 14(1)).

Provision · Art. 16(1); Art. 14(1), (3); Art. 15 on EUR-Lex

For the purposes of the notifications referred to in Article 14(1) and (3) and Article 15(1) and (2) and in order to simplify the reporting obligations of manufacturers, a single reporting platform shall be established by ENISA. The day-to-day operations of that single reporting platform shall be managed and maintained by ENISA. The architecture of the single reporting platform shall allow Member States and ENISA to put in place their own electronic notification end-points.

For a device maker

A formal record of the components in the software of the device and their supply chain relationships; Annex I Part II(1) asks for a machine-readable format covering at least the top-level dependencies.

Definition · Art. 3(39); Annex I Part II(1); Art. 13(24) on EUR-Lex

‘software bill of materials’ means a formal record containing details and supply chain relationships of components included in the software elements of a product with digital elements;

For a device maker

A change after placing on the market that affects conformity with Annex I Part I or changes the intended purpose that was assessed; recital 39 treats a security update that only lowers risk as generally not substantial.

Definition · Art. 3(30) on EUR-Lex

‘substantial modification’ means a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I or which results in a modification to the intended purpose for which the product with digital elements has been assessed;

For a device maker

The period in which the manufacturer must handle the vulnerabilities of the device in line with Annex I Part II; the manufacturer sets it under Art. 13(8).

Definition · Art. 3(20); Art. 13(8), (9), (19) on EUR-Lex

‘support period’ means the period during which a manufacturer is required to ensure that vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I;

For a device maker

The record of how the device and the manufacturer's processes meet Annex I, with at least the contents of Annex VII; kept for ten years after placing on the market or for the support period, whichever is longer (Art. 13(13)).

Provision · Art. 31(1); Annex VII; Art. 13(12)-(13) on EUR-Lex

The technical documentation shall contain all relevant data or details of the means used by the manufacturer to ensure that the product with digital elements and the processes put in place by the manufacturer comply with the essential cybersecurity requirements set out in Annex I. It shall at least contain the elements set out in Annex VII.

For a device maker

A weakness, susceptibility or flaw of the device that a cyber threat can exploit, in the firmware, a component or the hardware itself; a scanner finding is a signal that one may be present.

Definition · Art. 3(40) on EUR-Lex

‘vulnerability’ means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat;

For a device maker

The second notification, within 72 hours of becoming aware: general information on the device, the nature of the exploit and of the vulnerability, the corrective or mitigating measures taken and those users can take. For incidents, the incident notification of Art. 14(4)(b).

Provision · Art. 14(2)(b); for incidents Art. 14(4)(b) (incident notification) on EUR-Lex

unless the relevant information has already been provided, a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, which shall provide general information, as available, about the product with digital elements concerned, the general nature of the exploit and of the vulnerability concerned as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be;