Product

CRA conformance

The most likely route to CRA conformity for your product, and a way to follow it.

Enquire about this serviceAll services

Product

What you get

  • Classification of the product and its conformity route, including whether a notified body is needed
  • Annex I requirements traced to IEC 62443-4-1 and IEC 62443-4-2 through Eigenia's Requirements Traceability Matrix
  • Vulnerability handling, Article 14 reporting, SBOM and support period, with the obligations per market

Who it is for

Manufacturers of industrial and OT products sold into the EU

The Cyber Resilience Act sets cybersecurity requirements for products with digital elements placed on the EU market. This service is built for manufacturers whose products run plants, grids and buildings, and whose customers will ask for evidence of conformity.

  • PLCs and controllers
  • Drives
  • Sensors
  • Industrial gateways and switches
  • HMIs
  • Building-automation and energy equipment

Classes and conformity routes

  • Important products in class I may be assessed by the manufacturer itself, without a conformity assessment body, where harmonised standards are applied in full (CRA Article 32(2)).
  • Important products in class II and critical products need a third-party procedure (Article 32(3) and (4)). A notified body or test lab is brought in only where the product's class requires one.
  • IEC 62443-4-1 (secure product development) and IEC 62443-4-2 (technical security requirements for components) are the route we take to the CRA's essential requirements.

The application

Eigenia Conformance Pathway

Eigenia Conformance Pathway turns a description of the product, through Eigenia's Requirements Traceability Matrix (RTM), into the most likely pathway to CRA conformance, and then tracks the manufacturer along it.

  1. 01

    Describe the product

    What it is, what it connects to, how it is updated, and the markets it is sold into.

  2. 02

    Trace it through the RTM

    The RTM maps the CRA's requirements to IEC 62443-4-1 and 4-2, and to the evidence each one needs in the technical file.

  3. 03

    Follow the pathway

    The likely class, the conformity route and the dated obligations become a plan, and progress against it is tracked.

How to engage

From a first check to surveillance

Four steps, from a first indication to support once the product is on the market.

  1. 01Coming soon

    Free CRA readiness check

    Five inputs about the product give an indicative class and conformity route, the dated obligations with their sources, the rules per market, and a gap list.

  2. 02From USD 10,000

    CRA Readiness Assessment

    A fixed-scope assessment of about three weeks per product, sized by the RTM. It covers:

    • Classification and conformity route
    • Annex I against IEC 62443-4-1 and 4-2
    • Vulnerability handling and Article 14 reporting
    • SBOM and support period
    • Obligations per market, from Eigenia's jurisdiction research
    • Technical-file plan and roadmap
  3. 03Onboarding

    Onboarding into the method

    The manufacturer's team is taken through the method and set up in Eigenia Conformance Pathway, so the roadmap is worked from one place.

  4. 04Rate card

    Surveillance and support

    Ongoing support as the product, its standards and its markets change, on a rate card.

Workshops and larger programmes, across several products or product lines, are also offered.

Dates

The dates that set the pace

Each date is read from the EU record in Eigenia's jurisdiction research, with its legal basis and a link to the official text it was checked against.

11 June 2026

CRA: Chapter IV, notification of conformity assessment bodies, applies

Regulation (EU) 2024/2847, Article 71(2) · Official text

11 September 2026

CRA: manufacturers' reporting obligations (Article 14) apply

Regulation (EU) 2024/2847, Article 71(2) · Official text

14 January 2027

Machinery Regulation applies

Regulation (EU) 2023/1230, Article 54, second paragraph · Official text

11 December 2027

CRA: the Regulation applies in full

Regulation (EU) 2024/2847, Article 71(2) · Official text

The obligations per market come from Eigenia's jurisdiction research: 226 of 249 jurisdictions researched, every fact sourced, depth shown per country.

Open the jurisdiction researchRead the CRA in the CRA Hub CRA Hub

Start with the product

Send a short description of the product and the markets it is sold into. The enquiry form carries the service with it, or write to us directly.

info@eigenia.nl
Enquire about this service All services

This Site Uses No Cookies

Eigenia does not set cookies. The only thing stored in your browser is one preference, saved in local storage, noting that you have seen this notice.