Cyber Resilience Act evidence preparation.
Kaamos≥ organises Cyber Resilience Act requirements and links product risks, controls and evidence for preparation. Your team must secure the product, handle vulnerabilities and meet reporting duties. Conformity assessment and market surveillance remain outside a software readiness status.
What Kaamos helps prepare
- Organise CRA requirements
- Kaamos has a CRA framework catalog for product-security and vulnerability-handling requirements. Use it to organise the preparation work for your product.
- Link risks, controls and evidence
- Kaamos links risks, controls and evidence to the products in scope. People review whether that evidence addresses the product, release and requirement being assessed.
- Track preparation work
- Use Kaamos to track preparation for reporting and conformity-assessment duties. A tracked requirement still needs the underlying engineering work and a review of the resulting evidence.
What stays with people
- Product scope and assessment route
- Your team establishes which products and obligations apply and selects the applicable conformity-assessment route, with specialist advice when needed.
- Engineering and vulnerability handling
- The manufacturer must carry out secure development, maintain the product and handle vulnerabilities. A control entry or evidence attachment cannot perform those duties.
- Submissions and conformity
- Your team makes required submissions and completes the applicable conformity process, involving a notified body where required. Market surveillance authorities enforce the rules; Kaamos preparation status does not grant CE marking or conformity approval.
Requirements and scope
The CRA sets cybersecurity requirements for products with digital elements, covering design, development and maintenance. Manufacturers must handle vulnerabilities throughout the product lifecycle; some products require third-party assessment by a notified body.
Reporting obligations apply from 11 September 2026. The main obligations apply from 11 December 2027. National market surveillance authorities enforce the rules. See the existing CRA guide for product-scope questions and the reporting checklist.
- European Commission: CRA requirements, assessment and application dates
- Regulation (EU) 2024/2847: official legal reference
Reviewed .
Common questions
- How does Kaamos help with CRA evidence?
- Kaamos provides a CRA requirements catalog and links product risks, controls and evidence. It helps organise preparation for reporting and conformity-assessment duties; people review the evidence against the product and release.
- When do CRA obligations apply?
- Reporting obligations apply from 11 September 2026; the main obligations apply from 11 December 2027. The European Commission explains the timeline, and the linked CRA guide covers product scope and reporting preparation.
- Does Kaamos establish product conformity?
- No. The manufacturer completes the applicable conformity-assessment process and involves a notified body where required. Authorities retain their enforcement role. A Kaamos status or evidence record is preparation, not conformity approval.
Trace one requirement before choosing a tool.
Bring a product release and a vulnerability-handling requirement. Ask to trace its risk, control and evidence, then identify the engineering, reporting and conformity work still owned by your team.