Fossick › CRA scope check › Default product

Default category under the Cyber Resilience Act: what it means

The product is in scope but is not listed in Annex III or Annex IV, so it falls in the default category. This is where the large majority of products with digital elements land.

What the manufacturer must do

• Meet the essential cybersecurity requirements in Annex I, part I, including secure default configuration, no known exploitable vulnerabilities at release, and secure update delivery.
• Run a vulnerability handling process for the support period: maintain an SBOM in a machine-readable format, remediate without delay, and distribute security updates free of charge.
• Carry out a cybersecurity risk assessment and keep it in the technical documentation.
• Report actively exploited vulnerabilities and severe incidents to ENISA and the national CSIRT.
• Draw up the EU Declaration of Conformity and affix the CE marking.

Which deadlines apply

Reporting duties apply from 11 September 2026. Every other obligation, including the technical documentation and CE marking, applies from 11 December 2027.

What the conformity route looks like

Self-assessment (module A). No notified body is required: the manufacturer performs the conformity assessment internally and signs the Declaration of Conformity.

The reporting timeline

The reporting duty is the one that bites first, and it runs on three clocks that all start when the manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting the security of the product.

• 24 hours — early warning to ENISA and the CSIRT designated as coordinator in the Member State of main establishment.
• 72 hours — full notification, with an assessment of the vulnerability or incident and any corrective or mitigating measures taken.
• 14 days — final report once a corrective or mitigating measure is available: a description of the vulnerability, its severity and impact, and where available the exploitation vector.

The 14 day clock runs from the availability of the fix, not from the initial awareness, so a long remediation does not remove the earlier two deadlines.

Products already on the market are reached too

The reporting duty is not limited to new launches. From 11 September 2026 it applies to products with digital elements that are already placed on the EU market, for the whole time the manufacturer supports them. A product shipped in 2024 and still supported in 2027 is inside the regime, even though it was designed before it existed. The full set of obligations, including the technical documentation and CE marking, applies to products placed on the market from 11 December 2027, and to substantially modified versions of existing products after that date.

Check another product

• Rerun the CRA scope check
• Out of scope
• Important product, class I
• Important product, class II

This is guidance, not a legal determination. Classification under the Cyber Resilience Act depends on the full technical description of your product and, in borderline cases, on the assessment of a notified body or your national market surveillance authority.