Your Complete Cyber Resilience Act Compliance Checklist for 2026: An 8-Step Guide for Manufacturers

The cyber resilience act compliance checklist is now a top priority for every digital product manufacturer selling into the EU. This guide walks you through all eight steps - from product classification to CE marking. We cover essential cybersecurity requirements, vulnerability handling, conformity assessment, and automation strategies so you can meet CRA compliance requirements 2026 with confidence and zero last-minute surprises.

What Is the EU Cyber Resilience Act and Why Does It Matter

The cyber resilience act compliance checklist sits at the heart of the biggest shift in EU product cybersecurity regulation in a decade. The Cyber Resilience Act (CRA) is the European Union's landmark law that forces manufacturers to build security into every connected product. It applies to hardware, software, and firmware sold on the EU market.

Before the CRA, European cybersecurity legislation for IoT lacked teeth. Products could ship with default passwords, unpatched vulnerabilities, and zero long-term support. That era is now ending. The CRA creates clear digital product security obligations that every manufacturer must meet - or face steep penalties.

We believe this regulation changes the game. It shifts responsibility from the consumer to the maker. And it demands proof, not promises.

Which Products Fall Under the CRA

The CRA covers any product with digital elements that connects to a network or device. This includes smart home gadgets, industrial sensors, SaaS platforms, mobile apps, and operating systems. If your product processes or transmits data, it likely falls within scope.

Open-source software used in commercial products is included too. But purely non-commercial open-source projects get certain exemptions. The key test is whether the product reaches the EU market for a commercial purpose.

Default Category vs Annex III Class I and Class II

Most products fall into the default category. These carry lower risk and allow a simpler path to compliance. Annex III lists two higher-risk classes.

Class I includes products like password managers, VPNs, and network management tools. Class II covers critical items such as firewalls, intrusion detection systems, and industrial control systems. The class of your product determines the type of conformity assessment CRA requires.

Dec 2024 Entry, Sep 2026 Reporting, Dec 2027 Full Enforcement

The CRA entered into force in December 2024. But full enforcement rolls out in phases. By September 2026, manufacturers must begin reporting actively exploited vulnerabilities to ENISA. By December 2027, all CRA compliance requirements 2026 and beyond take full legal effect.

This timeline gives teams roughly two years to prepare. However, we strongly recommend starting now. Building a proper cyber resilience act compliance checklist takes time - especially for complex product lines.

The Complete Cyber Resilience Act Compliance Checklist

Here is the step-by-step cyber resilience act compliance checklist we recommend to every manufacturer. These CRA compliance steps for digital products cover classification, security design, documentation, and market access.

Step 1 - Product Classification Under Annex II and Annex IV

First, classify your product. Check Annex II for the list of important digital products (Class I) and critical digital products (Class II). Then review Annex IV to understand which conformity route applies.

If your product does not appear in Annex III, it falls under the default category. This is good news because default products allow self-assessment. Getting this step right early saves you months of confusion later.

Step 2 - Map Essential Cybersecurity Requirements to Your Product

The CRA defines a set of essential cybersecurity requirements in Annex I. These cover areas like access control, data protection, secure defaults, and integrity safeguards.

We map each requirement to specific product features and controls. This is where a risk assessment for connected products becomes critical. You need to identify threats, rate their severity, and show how your design mitigates each one. This step forms the backbone of your cyber resilience act compliance checklist.

Step 3 - Establish a Vulnerability Handling Process

The CRA demands a clear, documented vulnerability handling process. You must accept and triage vulnerability reports. You must issue security patches promptly. And you must notify ENISA of any actively exploited vulnerability within 24 hours.

On top of that, your security update obligations require you to provide free security updates for the expected product lifetime - or at least five years, whichever is shorter. We recommend building an internal response team and testing your process with tabletop exercises.

Step 4 - Generate and Maintain a Software Bill of Materials (SBOM)

Every product needs a machine-readable SBOM. This document lists all third-party components, libraries, and dependencies in your software. It helps you track known vulnerabilities across your supply chain.

We use automated tools to generate SBOMs during the build process. Keeping the SBOM updated after each release is a core post-market surveillance requirement. Regulators and customers may request it at any time.

Step 5 - Implement Secure-by-Design Development Practices

Security cannot be an afterthought. The CRA requires manufacturers to bake security into the entire product lifecycle. That means threat modeling during design, secure coding standards during development, and penetration testing before release.

We integrate security gates into every sprint. This approach reduces rework and builds a strong evidence trail. It also aligns with how to comply with the cyber resilience act at its core - by proving security is part of your DNA, not just a checkbox.

Step 6 - Prepare Technical Documentation and EU Declaration of Conformity

You must create detailed technical documentation that proves your product meets every essential requirement. This includes design specs, test results, risk assessments, and your SBOM.

You also need to draft an EU Declaration of Conformity. This is a formal statement that your product satisfies CRA rules. We keep these documents version-controlled and audit-ready at all times. This step alone can make or break your cyber resilience act compliance checklist.

Step 7 - Conduct or Commission the Conformity Assessment

The type of assessment depends on your product's classification. Default-category products can follow a self-assessment path using harmonized standards. Class I and Class II products face stricter requirements.

Self-Assessment vs Third-Party (Notified Body) Audits

Default products may use internal assessment - sometimes called Module A. Class I products can self-assess only if they follow a harmonized European standard or meet specific conditions. Otherwise, a third-party notified body must review them.

Class II products always require a notified body audit. We help teams prepare audit packages that satisfy notified body expectations the first time. Understanding the conformity assessment CRA process early prevents delays and surprise costs.

Step 8 - Affix the CE Mark and Register

Once you pass assessment, you can affix the CE mark to your product. This signals compliance with EU regulations, including CE marking cybersecurity rules under the CRA.

You must also register the product in the relevant EU database. After registration, your manufacturer obligations under CRA continue. You must monitor the product, handle vulnerabilities, and issue updates throughout its lifecycle.

Cyber Resilience Act Compliance Checklist - At a Glance

Here is a comparison table that shows the CRA compliance requirements 2026 by product class:

Compliance Factor	Default Category	Class I (Annex III)	Class II (Annex III)
Risk Level	Low	Important	Critical
Conformity Assessment	Self-assessment (Module A)	Self-assessment (if standards apply) or third-party	Third-party notified body required
SBOM Required	Yes	Yes	Yes
Vulnerability Reporting to ENISA	24-hour deadline	24-hour deadline	24-hour deadline
Security Updates	Minimum 5 years or product lifetime	Minimum 5 years or product lifetime	Minimum 5 years or product lifetime
Technical Documentation	Required	Required (more detailed)	Required (most detailed)
CE Marking	Required	Required	Required
Example Products	Consumer IoT, basic apps	Password managers, VPNs, routers	Firewalls, smartcard readers, industrial control systems
Full Enforcement Date	December 2027	December 2027	December 2027

Penalties for Non-Compliance - What Manufacturers Risk

The CRA carries serious penalties. Ignoring your EU cyber resilience act checklist for manufacturers is not an option.

Fines Up to €15M or 2.5% of Global Turnover

Non-compliance with essential cybersecurity requirements can trigger fines up to €15 million or 2.5% of annual worldwide turnover - whichever is higher. Smaller violations may still cost up to €10 million or 2%.

These numbers match the scale of GDPR fines. We have seen regulators across the EU become more aggressive with enforcement in 2025 and into 2026. Waiting until the deadline is a risky bet.

Product Bans and Market Withdrawal Scenarios

Beyond fines, authorities can order product recalls or ban products from the EU market entirely. If your product fails to meet its digital product security obligations, market surveillance authorities can act fast.

A product ban can destroy customer trust overnight. We always tell our clients: the cost of compliance is a fraction of the cost of a market withdrawal. Building your cyber resilience act compliance checklist now protects both your revenue and your reputation.

How to Automate CRA Compliance End to End

Manual compliance tracking breaks down at scale. That is exactly why we built UbiComply.ai. Automation turns a painful process into a smooth workflow.

Using a CRA Control Matrix to Track Progress

We map every CRA requirement to a control inside our platform. Each control has an owner, evidence links, and a status tracker. This gives leadership a real-time dashboard of their cyber resilience act compliance checklist progress.

A control matrix also simplifies audits. When a notified body asks for proof, you pull it from one place - not from scattered spreadsheets and email threads.

CI/CD-Integrated Scanning for Continuous Proof

We connect directly to your CI/CD pipeline. Every code commit triggers automated security scans, SBOM generation, and compliance checks. This approach delivers continuous proof of compliance - not just a snapshot from months ago.

Continuous compliance is the future. It reduces audit fatigue and catches issues before they reach production. Above all, it aligns perfectly with how to comply with the cyber resilience act in an agile development environment.

Common Mistakes to Avoid

Even well-prepared teams stumble. Here are pitfalls we see repeatedly:

Waiting for harmonized standards. Many teams pause until standards are finalized. But the CRA applies regardless. Start with Annex I requirements now and adapt later.

Ignoring the SBOM. Teams that skip SBOM generation early face painful catch-up work. Start generating SBOMs from day one.

Treating CRA as a one-time project. The CRA demands ongoing post-market surveillance requirements. Compliance is continuous, not a finish line.

Confusing CRA with NIS2. The CRA targets products. NIS2 targets organizations and critical infrastructure operators. Both matter, but they cover different ground.

FAQ

What is the Cyber Resilience Act in simple terms?

The CRA is an EU law that requires all digital products sold in Europe to meet minimum cybersecurity standards. It makes manufacturers responsible for security throughout a product's life.

Who needs to comply with the CRA?

Any manufacturer, importer, or distributor placing a product with digital elements on the EU market. This covers hardware, software, and connected devices. Your cyber resilience act compliance checklist applies whether you are based inside or outside the EU.

When does the Cyber Resilience Act come into force?

It entered into force in December 2024. Vulnerability reporting obligations begin in September 2026. Full enforcement starts in December 2027.

Is the CRA the same as CE marking for software?

Not exactly. The CRA adds cybersecurity to the CE marking process. Products that meet CRA requirements can carry the CE mark, showing they comply with this European cybersecurity legislation for IoT and digital products.

Can startups self-assess under the CRA?

Yes - if their product falls in the default category or qualifies under Class I with applicable harmonized standards. Class II products always need a third-party audit, regardless of company size.

What is the difference between CRA and NIS2?

The CRA focuses on product security. NIS2 focuses on organizational cybersecurity for essential and important entities. A manufacturer may need to follow both. They complement each other but serve different purposes within the EU's broader risk management and cybersecurity framework.

Conclusion

The cyber resilience act compliance checklist we outlined above gives you a clear, actionable roadmap. From product classification to CE marking, each step builds on the last. The CRA is not optional - and the deadlines are approaching fast.

We built UbiComply.ai to help manufacturers tackle exactly this challenge. Our platform automates control mapping, evidence collection, risk assessment for connected products, and audit readiness across the CRA and other frameworks like SOC 2, ISO 27001, ISO 42001, HIPAA, GDPR, CMMC, and NIST.

Start your cyber resilience act compliance checklist today. The teams that prepare early will enter 2027 with confidence. The ones that wait will scramble. We are here to make sure you land in the first group.

UbiComply.ai - Compliance automation, cybersecurity governance, and audit readiness for the frameworks that matter most.

 PCI DSS compliance helps us protect payment card data and reduce security risk. We use clear controls, strong access rules, secure systems, regular testing, and good records to build a safer payment environment. In 2026, PCI DSS v4.0.1 remains the current standard, making continuous compliance and audit readiness more important than ever.

PCI DSS compliance helps us protect payment card data from theft, misuse, and security threats. We use the Payment Card Industry Data Security Standard (PCI DSS) to create a secure environment for payment information.

PCI DSS applies to organisations that store, process, or transmit cardholder data. It can also apply to systems that can affect the security of the cardholder data environment (CDE).

In 2026, PCI DSS v4.0.1 is the current version listed by the PCI Security Standards Council (PCI SSC). The updated standard supports stronger security practices and clearer guidance for modern payment environments.

What Is PCI DSS Compliance?

PCI DSS compliance means we meet the security requirements that protect payment account data. The standard gives us a baseline for technical and operational security.

We can use PCI DSS to protect cardholder data across payment systems, applications, networks, cloud services, and connected technologies. We also need to consider systems that can affect the security of the CDE.

The goal is simple. We want to reduce the chance of unauthorised access, data loss, fraud, and other security events.

Why PCI DSS Matters

We cannot treat payment security as a one-time task. Threats change, systems change, and businesses change.

As a result, we need regular monitoring, testing, risk management, and evidence collection. This approach helps us maintain security between formal assessments.

The 12 PCI DSS Requirements

PCI DSS uses 12 main requirements to organise security controls. These requirements cover areas such as network security, account data protection, access control, monitoring, testing, and security policies.

PCI DSS area	What we focus on	Example activity
Network Security Controls	Secure network boundaries	Review firewall rules
Secure Configurations	Remove weak settings	Harden system configurations
Stored Account Data	Protect stored data	Limit and protect stored PAN
Data Transmission	Protect data in transit	Use strong encryption
Malware Protection	Detect malicious software	Maintain security tools
Secure Software	Build safer applications	Test application security
Access Control	Limit access	Apply least privilege
Authentication	Verify users	Use strong authentication
Physical Access	Protect physical systems	Restrict facility access
Logging and Monitoring	Track security events	Review audit logs
Security Testing	Find weaknesses	Run vulnerability scans
Security Policies	Define responsibilities	Maintain security policies

We should not treat these areas as separate projects. Instead, we should connect them through one security and compliance programme.

PCI DSS Compliance in 2026

PCI DSS v4.0.1 remains important in 2026. PCI SSC published the revision in June 2024 and continues to provide supporting documents, SAQs, reporting templates, and guidance.

We also see PCI SSC continuing to update guidance around modern payment technologies and security practices. In July 2026, PCI SSC published guidance related to compensating controls and the customised approach.

This tells us something important. Compliance needs to keep pace with technology.

Understanding the Cardholder Data Environment

We first need to understand our CDE. We identify where payment data enters, moves, gets processed, and gets stored.

We also map connected systems that can affect payment security. This can include servers, applications, cloud services, network devices, security tools, and administrative systems.

Good scoping can reduce unnecessary compliance work. It can also help us identify systems that need stronger protection.

How We Build PCI DSS Compliance

1. Define Our Scope

We start by mapping payment data flows. We identify systems that store, process, or transmit cardholder data.

Next, we identify connected systems that can affect the CDE. We document these relationships clearly.

A clear scope gives us a strong starting point for the assessment.

2. Assess Our Security Controls

We compare our current controls with the applicable PCI DSS requirements. We look for missing controls, weak processes, and incomplete evidence.

We should record each gap and assign an owner. We can then track remediation from identification to closure.

3. Protect Cardholder Data

We limit access to payment data. We also protect sensitive information with appropriate security controls.

We should avoid keeping payment data that we do not need. Data minimisation can reduce our exposure and simplify our security responsibilities.

4. Secure Access

We apply least privilege. Users should receive only the access they need to perform their work.

We also maintain strong authentication and review access regularly. When someone changes roles, we update their access quickly.

5. Monitor and Test

We collect security logs and monitor important events. We also perform vulnerability scans and other required security tests.

Regular testing helps us find weaknesses before they become serious problems. It also creates useful evidence for compliance assessments.

Common PCI DSS Mistakes

Poor CDE Scoping

A common mistake is treating every system as part of the CDE without reviewing actual data flows. Another mistake is excluding systems that can affect payment security.

We should document our scope and review it whenever our environment changes.

Treating Compliance as a One-Time Project

PCI DSS compliance should not end after an assessment. Systems continue to change after an assessment.

We need continuous monitoring, regular control reviews, and updated evidence.

Weak Evidence Management

A control may work correctly, but missing evidence can create assessment problems. We should keep records that show when controls operated and who performed important activities.

Good evidence also makes audits easier and faster.

Ignoring Third-Party Risk

Payment environments often rely on service providers. We need to understand which services affect our CDE and what responsibilities each party has.

We should also maintain clear contracts, responsibilities, and evidence for relevant third-party controls.

How Compliance Automation Helps

Manual compliance work can become difficult as environments grow. We may need to collect evidence from many systems and repeat the same checks.

Compliance automation can help us centralise tasks, evidence, findings, and remediation. It can also support continuous compliance rather than relying only on periodic reviews.

With a platform such as UbiComply.ai, we can connect compliance activities with broader cybersecurity, risk management, governance, and audit readiness processes.

Continuous Compliance

We can monitor controls throughout the year instead of waiting for an audit. This gives us better visibility into changes and new risks.

We can also track evidence, assign remediation tasks, and monitor progress from one place.

This approach supports stronger compliance automation and helps us prepare for assessments with less manual effort.

PCI DSS and Other Compliance Frameworks

PCI DSS is focused on payment security, but we can align its controls with broader security frameworks.

We may also work with SOC 2, ISO 27001, HIPAA, GDPR, CMMC, ISO 42001, and NIST requirements. Some controls overlap, such as access management, logging, risk management, vulnerability management, and security policies.

We should not assume that one framework automatically proves compliance with another. Instead, we can map related controls and reuse suitable evidence where the requirements allow it.

Best Practices for PCI DSS Compliance

Build a Clear Control Programme

We define each control, assign an owner, and identify the evidence we need. We also set review dates.

This creates accountability and makes gaps easier to track.

Keep Evidence Ready

We collect evidence throughout the year. This can include policies, access reviews, vulnerability reports, logs, scan results, training records, and configuration records.

As a result, we spend less time searching for evidence during an assessment.

Review Changes

Business and technology changes can affect PCI DSS scope. We review new applications, cloud services, vendors, integrations, and payment processes.

A change review helps us identify compliance impacts early.

Automate Repetitive Work

We automate evidence collection and recurring checks where possible. This reduces manual work and helps us spot issues faster.

Automation does not replace security expertise. Instead, it helps our teams spend more time on important risks.

FAQ

What is PCI DSS?

PCI DSS is a security standard designed to protect payment account data. It provides technical and operational requirements for organisations involved in payment card processing.

What is the current PCI DSS version in 2026?

PCI DSS v4.0.1 is the current version listed by PCI SSC in 2026.

Who needs PCI DSS compliance?

Entities that store, process, or transmit cardholder data or sensitive authentication data can fall within PCI DSS scope. Systems that can affect the security of the CDE can also be relevant.

Is PCI DSS compliance a one-time activity?

No. We should manage PCI DSS as an ongoing security programme. Continuous monitoring, testing, evidence collection, and remediation help us maintain compliance as our environment changes.

Can automation help with PCI DSS?

Yes. Automation can help us organise controls, collect evidence, track gaps, monitor activities, and improve audit readiness. We still need qualified people to review risks and make appropriate decisions.

Conclusion

PCI DSS compliance gives us a structured way to protect payment data and strengthen security. We start with clear CDE scoping, then apply strong controls for access, data protection, monitoring, testing, and risk management.

In 2026, we should treat compliance as an ongoing process rather than a yearly project. With compliance automation, continuous monitoring, and strong audit readiness, we can reduce manual work and respond to security risks faster.

At UbiComply.ai, we can bring compliance, cybersecurity, governance, and risk management activities together in one programme. This helps us build a stronger and more consistent approach to continuous compliance.