What the CRA asks of a one-person firm

If you are the whole company — one person, or two — the first thing you want to know is whether the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) has a small-firm exemption. It does not. The essential requirements fall on the manufacturer of a product with digital elements, and the Regulation does not scale them by headcount. Five things are lighter for a micro or small enterprise, though three of the five reach medium-sized enterprises too. This guide says what each covers and what it does not. It is a documentation aid, not legal advice.

Is my chip CRA compliant?

A common first question, and it has two halves. A chip, a module, an RTOS or a library that is sold on its own is itself a product with digital elements: Article 3(1) defines the term as "a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately". So the component has a manufacturer of its own, with their own duties for the thing they sell, and from 11 December 2027 it may carry its own CE marking and EU declaration of conformity. Looking for those is part of your due diligence, not a courtesy: recital 34 names, among the checks that due diligence is made of, "verifying, as applicable, that the manufacturer of a component has demonstrated conformity with this Regulation, including by checking if the component already bears the CE marking" (Article 13(5)). Our guide "Due diligence on open-source components" says what to ask a supplier for and what to write down.

The other half is the one the question usually misses: none of that makes your product conform. The duty for the finished product with digital elements sits with whoever places that product on the EU market under their own name or trademark (Article 3(13)). If that is you, the duty is yours, whichever chip is inside. A component that carries its own CE marking is a fact you record and lean on, never a declaration about your product.

What a silicon vendor's documents are good for (argument, from how Article 13 is written): they are evidence you can use in your own assessment. Article 13(5) asks you to exercise due diligence when you build in third-party components, and a vendor's security notes, advisories, update policy and — once the component itself carries one — its own CE marking and declaration of conformity are the kind of thing that due diligence reads. They are also inputs to your SBOM and to your Annex VII technical file.

What they are not: they do not transfer the duty to the vendor, and they do not make your product compliant, certified or approved. Whatever duties the chip's own maker has for the part it sells are theirs; they neither pass to you nor take yours away. Asking the vendor which documents they can give you is a sensible step. Waiting for the vendor to declare the product conformant is not, because they cannot do it for a product they do not make.

The rest of this guide is what that duty asks of a one-person firm.

There is no size exemption from the essential requirements

Article 13 puts the obligations on the manufacturer: the product meets the Annex I essential requirements when it is placed on the market, and its vulnerabilities are handled for the support period. Manufacturer is a role, not a size. A sole trader selling one connected sensor owes the same Annex I Part I requirements and the same Part II vulnerability handling as a company of five hundred. Micro and small means the EU definition — fewer than 50 staff and an annual turnover or balance sheet total of at most €10 million (Article 3(19), which points at Recommendation 2003/361/EC). One person is comfortably inside it.

Five things in the Regulation are genuinely lighter. This guide covers each one.

One fine does not apply — Article 64(10)(a). Administrative fines do not apply to a micro or small enterprise for failing to meet the 24-hour early-warning deadline (Article 14(2)(a) or (4)(a)), and recital 120 adds that Member States should not impose other penalties of a pecuniary character for it either. This is settled law: since the corrigendum of 2 July 2025 (Official Journal L 2025/90555) Article 64(10) opens "By way of derogation from paragraphs 2 to 9", and the fine for an Article 13 or Article 14 failure is set in paragraph 2, so the derogation reaches it on the face of the text. Earlier printings read "paragraphs 3 to 9"; a copy that does predates the correction.

Not covered: the duty to send the early warning, which still applies; the 72-hour notification and the final report, which have no relief; medium-sized enterprises, which get none of it; and anything an authority can do that is not a money penalty. The relief is from the fine, not from the duty. Our advice (argument): treat the 24-hour clock as a duty you meet, not a deadline you may miss cheaply.

A shorter technical-documentation form is promised — Article 33(5). A micro or small enterprise may provide the Annex VII technical documentation in a simplified form the Commission is to set by implementing act, and notified bodies must accept that form.

Not covered: anything you can use today. No form had been published when our legal state was recorded on 7 October 2026, and a re-check on 9 October 2026 found no published form, no draft and no expected date — so you provide the full Annex VII content. It will change the form, not the substance: the risk assessment and the requirement-by-requirement and support-period reasoning are still what gets written down.

Member States and the Commission are told to support you — Article 33. Article 33 is the CRA's support-measures article for micro, small and medium-sized enterprises; paragraph 5 above is the part of it that changes what you hand over.

Not covered: any duty. Support is awareness, guidance and assistance; none of it removes a requirement or moves a deadline.

Notified-body fees take your size into account — Article 32(6). Where a notified body carries out your conformity assessment, the fees it charges must take into account the specific interests and needs of micro, small and medium-sized enterprises and be reduced in proportion to them.

Not covered: anyone not going through a notified body, and as of our 8 October 2026 check, no notified body had been designated under the CRA in the Commission's NANDO database, so there is not yet one to apply to and the relief has nothing to act on yet. Like Article 33 above and Article 64(5)(c) below, it runs wider than micro and small: medium-sized enterprises get it too.

Your size is weighed when a fine is set — Article 64(5)(c). When an authority decides the amount of an administrative fine it gives due regard to the circumstances of the case, and one of those circumstances is the size of the operator, in particular with regard to microenterprises and small and medium-sized enterprises, including start-ups.

Not covered: any reduction you can count on. This is not an exemption, not a ceiling and not a discount you can work out in advance: it is a factor the authority weighs once it has decided to fine you, and it removes no duty and shortens no deadline. It reaches medium-sized enterprises and start-ups as well as micro and small. Our reading (argument): plan as though the full Article 64(2) tier applies to you, and treat this as mitigation an authority may choose to apply, not relief you can count on.

The support period, and what it costs one person

At least five years — unless the product is expected to be in use for less, in which case the support period corresponds to the expected use time, and longer where the product is expected to be in use for longer. Article 13(8) asks the period to reflect the length of time during which the product is expected to be in use, so five years is the floor and not the answer. No small-firm discount is in that sentence. Our guide "What the CRA support period means" covers choosing the length and where the end date must be shown; this guide does not repeat it.

What it costs you specifically (argument): a support period is a promise that someone can still build, sign and ship an update years from now. For one person the binding constraints are the toolchain you can still reproduce, the signing key you can still reach, and the upstream whose fixes you carry yourself if its support ends before yours. Check those three before you pick a date; they, not the triage work, are what make a long promise expensive.

Reporting does not wait for the support period

Article 14 has applied since 11 September 2026 (Article 71(2)), and Article 69(3) applies it to in-scope products placed on the market before 11 December 2027 — a device you shipped in 2024 is covered today. The trigger is awareness: an actively exploited vulnerability contained in the product, or a severe incident having an impact on the security of the product. Our guide "Article 14 step by step" walks the clocks and the recipients.

That trigger and those clocks are what the text says. Argument: we have found no provision in Article 14 that ends those duties when the support period ends, and none that extends them either — so we plan for a report about an out-of-support product rather than assume the comfortable reading.

The standards gap: you show conformity against Annex I itself

No harmonised standard for the CRA is cited in the Official Journal. The horizontal drafts prEN 40000-1-1 to prEN 40000-1-4 (vocabulary; principles, risk management and lifecycle; vulnerability handling; generic security requirements) were still drafts when we checked on 9 October 2026, and a draft gives no presumption of conformity until its reference is published in the Official Journal. EN 18031-1 is cited — but under the Radio Equipment Directive, by Commission Implementing Decision (EU) 2025/138 of 28 January 2025 — and says nothing about the CRA. ETSI EN 303 645 carries no presumption either.

So a small firm shows conformity against Annex I directly: requirement by requirement, in your own words, with your evidence beside each. That is more writing than citing a standard would be, and it is what every manufacturer is doing at the moment — not a small-firm problem.

What we would do first in your shoes (argument)

1. Decide whether each product is in scope at all, and write the reason down in a paragraph. That paragraph is what you show when asked.
2. Pick the support period and record the reasoning Annex VII asks the technical documentation to contain. It dates everything else.
3. Set up what Article 14 needs before you need it: the personal EU Login for ENISA's Single Reporting Platform, and a note of which CSIRT coordinates for your Member State. A 24-hour clock is not the moment to register an account.
4. Get an SBOM out of your build and keep it current (Annex I, Part II, point 1). For one person it is the only way to answer "does this new CVE affect me?" in an hour rather than a week.
5. Publish a vulnerability contact address and a coordinated disclosure policy (Annex I, Part II, points 5 and 6). One page and one mailbox, done once.

Write the requirement-by-requirement reasoning and the declaration last, when the facts behind them have settled.

What is settled and what is not

Settled (law, in the articles cited): the obligations sit on the manufacturer whatever its size; that a component placed on the market on its own is itself a product with digital elements (Article 3(1)); the Article 33(5) form as a promise not yet delivered; the Article 32(6) notified-body fee relief and its limits; that Article 64(10)(a) excludes the fine for a late 24-hour early warning for a micro or small enterprise; that Article 64(5)(c) makes your size a factor in setting a fine; the five-year support-period floor, and that a longer expected use time makes the period longer; the Article 14 trigger, its application date and its reach to products already on the market; and that no CRA harmonised standard is cited in the Official Journal.

Labelled argument, and nothing else is: the 24-hour clock advice; what Article 64(5)(c) is worth in practice; the support-period cost reasoning; the reading that Article 14's duties do not end with the support period; and the five first steps.

How we checked: every source below carries the date we read it. Recital 34 was re-read in the Official Journal text on EUR-Lex on 11 October 2026 and is quoted above word for word. The articles themselves could not be re-read at source that day — the Official Journal page does not hand its articles section to the machine that wrote this revision — so each article date below is the date that text was last read at source, and the next revision re-reads them.