The CRA glossary

The trigger for the reporting duty: the only vulnerability state that starts a 24-hour clock.

The coordination body of the national market surveillance authorities. It orders nothing against a company, but it shapes what those authorities measure against.

The sum of all the places where an attacker can interact with a product. Annex I requires keeping it small, measured against the risk.

The mandated representation inside the Union, which takes on specified tasks but expressly not the manufacturer’s core obligations.

The manufacturer’s own declaration that product and processes meet the requirements. No authority certifies it: it is a self-declaration that carries liability.

The interpretive material the Commission publishes under Article 26. It eases application of the CRA, but replaces no standard and creates no presumption of conformity.

The CRA fallback for when standardisation does not deliver: technical requirements adopted by the Commission with the same effect as a harmonised standard.

Software or hardware meant for integration, for as long as it stays integrated. Marketed separately, it becomes a product with the full set of obligations.

The demonstration that a product meets the essential requirements: self-assessed or with a notified body, depending on the product category.

The testing and certification organisation that has to satisfy Article 39 before a Member State may designate it as a notified body. The CRA borrows the term itself from accreditation law.

The four routes in Article 32 by which a manufacturer demonstrates conformity, from self-assessment to a quality system audited by a notified body.

The CRA adopts the standard consumer definition but attaches very few rules to it. For a manufacturer’s obligations it is rarely the deciding factor.

The defined process for how vulnerability reports from outside arrive, get handled and eventually become public. For manufacturers it is an obligation, not a nicety.

The three product categories in Annex IV, the only ones that can be made subject to mandatory European certification. Until that happens, the Article 32(3) procedures apply.

The national body that receives a manufacturer’s mandatory notifications. It is not created by the CRA but designated under Article 12(1) of the NIS2 Directive.

The unique identifier for publicly known vulnerabilities. Essential for matching against your bill of materials, but not a statement about risk.

The widely used scoring system for vulnerability severity, which only becomes meaningful once your own context is factored in.

Controlled testing environments before placing on the market that a Member State may set up but need not. They ease the run-up to conformity without replacing it.

The yardstick that decides whether a weakness counts as a vulnerability. Cyber threats themselves are only ever reported voluntarily.

The purpose of the whole Regulation is the one notion the CRA does not spell out itself. It borrows the wording of the Cybersecurity Act, and what is meant are activities, not a state once achieved.

Magnitude and likelihood of an incident together make up the measure that decides which Annex I requirements apply to a product in the first place.

One of the two established exchange formats for software bills of materials. The CRA never names it, yet it satisfies the Annex I requirement.

Article 2(1) hangs the entire scope of the CRA on a single feature. Four forms of connection are provided for, and one of them is enough.

The lightest role in the supply chain. But only as long as the product’s properties remain untouched.

Article 13(5) makes manufacturers answerable for building blocks they did not write themselves. How deep the checking has to go depends on the risk of the individual component.

The umbrella term the CRA uses whenever it addresses every role that carries obligations at once, from manufacturer and representative to importer and distributor.

The CRA’s base technical term. On its own it creates no manufacturer obligation, yet it carries the definitions of software, hardware and component.

A device becomes an end-point through its role in a network, not through its form factor. The CRA defines the term but attaches no obligation of its own to it.

The European Union Agency for Cybersecurity. The CRA does not create it, but makes it the second recipient of every mandatory notification and the operator of the reporting platform.

Annex I of the CRA: thirteen requirements for the product and eight for the manufacturer’s processes. Without both, a product cannot reach the market.

The manufacturer’s binding statement that a product meets the requirements. Without it there is no CE marking; with it, responsibility is assumed.

The fourth route to conformity: a certificate issued under a scheme of the Cybersecurity Act, which can even become compulsory for critical products.

The wider category that harmonised standards come from. Adopted by CEN, Cenelec or ETSI, voluntary to apply, and on its own carrying no presumption of conformity.

The European record of known vulnerabilities run by ENISA. The CRA does not establish it, but draws on it at both ends of the vulnerability process.

The middle of three levels. It sets no reporting clock running, yet it blocks every further shipment for as long as it is known and unfixed.

The definition sits in Article 3(48), but it does not decide the scope. Open-source software is caught only once it is made available on the market in the course of a commercial activity.

The physical counterpart to software. The classification helps decide where identifiers and the CE marking go, and what the technical documentation has to show.

Voluntary to apply, but with a substantial benefit: comply with one and your product is deemed conformant to that extent.

Annex III of the CRA lists 19 categories in class I and four in class II. A product that has their core functionality loses the free choice of how to assess its conformity.

Whoever first brings third-country products onto the Union market carries real verification duties, but not the manufacturer’s development responsibility.

The second reporting trigger alongside actively exploited vulnerabilities, defined through NIS2 and narrower than everyday usage suggests.

An incident that harms, or could harm, a product’s ability to protect data or functions. It only has to be reported where Article 14(5) makes it severe.

The term that pulls products with no network access of their own into scope, as soon as the system around them can be connected.

The information package Annex II requires with every product, from the vulnerability contact point to the end date of the support period.

The duty to inform impacted users about actively exploited vulnerabilities and severe incidents. It sits alongside the notification to authorities and is not discharged by it.

The use a manufacturer states for a product, and the reference point for scope, risk assessment and the reach of every obligation.

Pulled in through the European standardisation regulation and limited to three bodies: a usable working basis, but no presumption of conformity.

The kind of connection that needs no cable or plug. For pure software it is the route into the scope of the CRA.

Any supply for distribution or use in the course of a commercial activity, whether paid for or not.

The role carrying by far the most obligations, and one you take on faster than expected: selling under your own name is enough.

The national body that enforces the CRA: it requests documentation, orders corrective action and imposes the fines.

Not a separate class of obligations but a size classification borrowed from Recommendation 2003/361/EC. It governs simplified documentation, reduced fees and one narrow exemption from fines.

The conformity assessment procedure a manufacturer runs alone: no notified body, no certificate, but the obligations in points 2, 3 and 4 of Annex VIII, Part I.

The part of a conformity assessment procedure in which a notified body examines and certifies the type. On its own it does not open the market.

The second step after EU-type examination. Here the manufacturer alone ensures that every unit produced matches the type that was examined.

The one CRA procedure in which a notified body examines no type at all but approves the manufacturer’s quality system and then keeps it under surveillance.

The event that almost became an incident: outside the Article 14 reporting duty, but open to voluntary notification under Article 15.

The independent organisation behind third-party conformity assessment of important and critical products, designated by a Member State and listed by the Commission.

The national body behind the notified bodies. It assesses, designates, notifies and monitors the assessment organisations of a Member State.

A role of its own for foundations and entities that sustain open-source development without being manufacturers. The list of duties attached to it is much shorter.

Three tiers of administrative fine reaching EUR 15 million or 2.5 % of worldwide annual turnover, capped by the CRA and imposed under national law.

A term the CRA borrows from the GDPR. It rarely decides whether an Annex I requirement applies, but it does decide how heavily the risk weighs.

Electrical, optical and mechanical interfaces, wires and radio waves: the CRA draws the physical connection widely, and radio sits in the same list as the cable.

The first making available on the Union market: the point by which assessment, documentation and marking must all exist.

Apply one of the three rulebooks in Article 27 and compliance need not be derived requirement by requirement, but only in so far as the rulebook covers it.

This term decides whether the CRA applies to a product at all. It reaches considerably further than the wording first suggests.

The use that runs against the intended purpose and still has to be expected. In the Regulation it has exactly one home: the information for users.

The use that is not necessarily the intended purpose and still has to be expected. It helps decide whether a product is in scope, and it belongs in the risk assessment.

The sharpest corrective measure in the CRA: it aims at the return of products that have already reached the end user, whether driven by the manufacturer itself or ordered by an authority.

Whether a backend is regulated along with the product turns on this term. It qualifies the common assumption that SaaS is out of scope.

The most time-critical requirement in the CRA: two triggers, three stages, and a deadline that runs in calendar time.

The fix the CRA requires without delay, free of charge and, where feasible, separately from functionality updates. It has to stay retrievable for ten years after it is issued.

The threshold at which a risk turns into a procedure: a high likelihood of an incident and severe consequences have to be present together.

The reporting route the CRA runs on, operated by ENISA. One notification, one national end-point, and behind it distribution to every authority concerned.

Not a thing in its own right under the CRA, but the part of a system that consists of computer code. Obligations attach only once it is a product or a component.

The machine-readable record of every component in a product. Any vulnerability analysis builds on it, and the CRA requires it explicitly.

The bill of materials format that grew out of licence compliance. The CRA never names it, and it still answers the Annex I duty well.

The threshold at which an already marketed product must be reassessed. Crossing it can turn a distributor into a manufacturer.

The period during which vulnerabilities must be handled. At least five years, measured against how long the product is expected to be used.

The evidence behind the declaration of conformity, which must exist before placing on the market and stay available for at least ten years.

The CRA has been in force since December 2024 but takes effect in stages: Chapter IV since June 2026, Article 14 from September 2026, everything else from December 2027.

The collective name for the body of EU product law the CRA joins. It governs CE marking, the single declaration of conformity and the reach of notified bodies.

The escalation stage of CRA enforcement. It settles whether one Member State’s measure against a product applies across the Union or has to be withdrawn.

The machine-readable statement of whether a known vulnerability actually affects your product. It is the answer to the noise from bill-of-materials matching.

The deliberately broad starting point of all vulnerability handling, and by no means the same thing as a defect.

The corrective measure that stops the supply line: it catches everything that has not yet reached the end user, from warehouse stock to shelf stock to download offers.