If you sell software or a connected device in the EU, you now need a security file.

Generally no. The Regulation reaches products with digital elements that are placed on the EU market, which means something supplied for distribution or use — software or hardware a customer installs or operates. Pure software-as-a-service, where nothing is installed and the offering is sold as a service, is normally outside it, and is covered by NIS2 instead. The line is not always clean: a SaaS product shipped with a desktop agent, a mobile app or an on-premise component brings that component into scope. How the CRA and NIS2 divide up.

Five: the technical documentation (Article 31 and Annex VII), the EU declaration of conformity (Article 28 and Annex V), the information and instructions for the user (Annex II), a coordinated vulnerability disclosure policy (Annex I Part II point 5), and the reasoning behind your support period (Article 13(8)). The technical documentation and the declaration must be retained for at least ten years after the product is placed on the market, or for the support period if that is longer. What to do, in what order.

It is already partly in force. Article 71(2) applies most of the Regulation from 11 December 2027, but the reporting duties in Article 14 have applied since 11 September 2026, and Article 69(3) extends them to products placed on the market before December 2027. So an existing product range is inside the reporting regime now, even though no CE marking or declaration of conformity is due until the end of 2027. Every date, and which standards are still missing.

Three, from the moment you become aware of an actively exploited vulnerability or a severe incident: an early warning within 24 hours, a fuller notification with an assessment within 72 hours, and a final report within 14 days of a corrective measure being available — one month for incidents. They go to the CSIRT designated by the Member State of your main establishment and to ENISA simultaneously, through the Single Reporting Platform, which needs an account and two-factor authentication set up in advance. The two tracks and all four deadlines.

Only where it is monetised. The Regulation reaches products supplied in the course of a commercial activity, so a project nobody charges for is outside it — but paid support beyond cost recovery, paid hosting or a dual licence brings it in as an ordinary product. There is a third category: an open-source software steward under Article 24, which is in scope but under a much lighter regime with no CE marking, no technical documentation, no declaration of conformity and no SBOM duty. Where maintainers and stewards actually stand.

Yes, if you place the product on the EU market. The obligations follow the product, not your address, and a manufacturer established outside the Union must appoint an authorised representative in it. The importer and distributor also carry their own duties, and a distributor who puts their own name on someone else's product is treated as the manufacturer of it. Importers, distributors and rebranders.

Most manufacturers do not. A default product can self-assess under Annex VIII Module A. Annex III Class I products can also self-assess if a harmonised standard, European cybersecurity certification scheme or common specification is applied in full — and none has been published for this Regulation yet, which is why Class I is currently the awkward case. Annex III Class II and Annex IV critical products need third-party involvement. When a third party has to be involved.