Where can I get further information on the application of the CRA?

To ensure smooth implementation of the CRA, the European Commission has set up a web page about the reporting obligations, which includes the document “FAQs on the CRA Implementation”. Section 5 provides more details on the reporting obligations under the CRA.

On 27 July 2026, the European Commission also published its Guidance to support timely Cyber Resilience Act implementation. In particular, Section 9.1 provides detailed guidance on the reporting obligations of manufacturers and open-source software stewards.

ENISA has also published guidance and supporting documents on the use of the CRA SRP, which are available on the main CRA SRP page and are updated as necessary.