Short, sourced explanations of what the Cyber Resilience Act asks of device makers and how to prepare for it.
A plain-English guide for teams shipping ESP-IDF firmware into the EU: what esp-idf-sbom already gives you, why the closed radio libraries and managed components still need attention, and what to do next.
esp-idfChecked on 11 October 2026
A plain-English guide for teams shipping Yocto-built Linux images into the EU: the Cyber Resilience Act dates, what the create-spdx SBOM contains in each release, why its CPEs are only as good as CVE_PRODUCT, and what to do next.
yoctoChecked on 11 October 2026
A plain-English guide for teams shipping Zephyr firmware into the EU: the Cyber Resilience Act dates, the SBOM it asks for, what west spdx produces and lacks, and a short list of what to do next.
zephyrChecked on 11 October 2026
The CRA reporting duty that has applied since 11 September 2026, as a timeline: what counts, who you report to, what goes in the 24-hour early warning, the 72-hour notification and the final report, and when each is due.
Checked on 14 October 2026
A short, copy-paste request for the four things makers ask their components' suppliers for (an SBOM, release attachments, build evidence, an advisory contact), what to do with each answer including silence, and what to do when a component has nobody to ask.
Checked on 14 October 2026
For radio device makers: the RED cybersecurity requirements that have applied since August 2025 and their EN 18031 standards, the Cyber Resilience Act that replaces them in December 2027, and what carries over.
Checked on 14 October 2026
How the CRA declaration of conformity fits with the declarations a connected device already carries under the Radio Equipment Directive and the EMC Directive: one document, what it contains, who signs it, what goes with the product and how long it is kept.
Checked on 14 October 2026
A product designed before the CRA and still sold after 11 December 2027 does not necessarily need a new design: the risk assessment decides. The three cases by date, what the Commission's draft guidance says about older designs, what you still owe, what you are not asked for, and when the answer is yes.
Checked on 14 October 2026
When a server your device or app talks to counts as part of the product under the CRA, and when it is a third-party component instead. The two questions and three outcomes from the Commission's draft guidance, what counts as a function, IaaS, PaaS and SaaS, five worked cases, what it costs you in documentation, risk assessment and due diligence, and what is not settled.
Checked on 14 October 2026
Buy a finished connected device from a factory and sell it in the EU under your own brand, and Article 21 of the CRA treats you as its manufacturer, with every Article 13 and 14 duty. What the article says, what it hands you, how the Commission's July 2026 draft guidance reads "substantial modification", and what to ask the factory for before you sign.
Checked on 14 October 2026
The Cyber Resilience Act support period in plain English: the five-year floor, the factors for choosing a length, where the end date must be shown, and the duties that run until it ends and beyond.
Checked on 14 October 2026
What the Cyber Resilience Act's duty to exercise due diligence on third-party and open-source components asks of a device maker, what it does not ask, what counts as evidence, reporting flaws upstream, and what open-source stewards owe.
Checked on 13 October 2026
Default, important class I, important class II and critical: what each CRA tier changes in practice (self-assessment or a notified body), which devices fall in each, and how core functionality decides it.
Checked on 13 October 2026
There is no size exemption from the CRA's essential requirements. A chip, module or RTOS sold on its own is a product with digital elements in its own right and may carry its own CE marking, which is evidence for your file — but it does not move the duty off the manufacturer of the finished product. What is actually lighter for a micro or small enterprise, with the article for each; the support period and what it costs one person; why reporting does not wait for the support period; and how a small firm shows conformity while no harmonised standard is cited.
Checked on 13 October 2026
People say the CRA fines manufacturers for security flaws in their products. It fines missing duties, not the existence of a flaw. The three tiers of Article 64 and what each attaches to, what Annex I asks about vulnerabilities at release and after it, what does get a maker into trouble, the two dates, and what is not known.
Checked on 13 October 2026
The operational side of the CRA support period: when a period under five years can be defended, what happens if you extend or shorten it after publishing, how to handle hardware variants and long sales lives, and what the end-of-support notice must do.
Checked on 11 October 2026
One level below the RED and CRA comparison: what the three EN 18031 parts assess, what the CRA really says about them (recital 30, not a substitution), and which Annex I points each EN 18031 mechanism gives you evidence for.
Checked on 11 October 2026
Why a firmware SBOM full of file names finds no vulnerabilities, how CPE and Package URL identifiers work, and where the C libraries in Zephyr, Yocto and ESP-IDF builds come from.
Checked on 11 October 2026
A plain-English comparison for teams shipping Zephyr, Yocto or ESP-IDF products: what each project's own security page tells you, and what the CRA still leaves for you to document.
Checked on 11 October 2026
Why a firmware SBOM over-reports CVEs for big components such as ESP-IDF, Zephyr and Linux, how to check your build configuration, and how to record a "not affected" decision with evidence instead of a hunch.
Checked on 11 October 2026
For a one- or two-person hardware maker: why the CRA asks for a disclosure policy, what safe harbour gives a researcher and you, how to handle the first day after a report, what not to promise, and where security.txt fits.
Checked on 8 October 2026
Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.