Skip to main content

The Compliance Obligation Matrix

The Compliance Obligation Matrix lists the CRA vulnerability-handling articles and the artifacts that each article requires. Open CVD Readiness in the sidebar. The page shows the matrix in two parts, the groundwork by phase and the December 2027 artifact matrix. The full matrix is also at /settings/obligations.

Each artifact is one of two types.

  • Portal artifact. The portal manages it for you.
  • Tenant artifact. Your team creates it. For each tenant artifact, you can tick a checkbox, add a note, and paste a URL to your evidence.

The header shows your overall percentage and the number of completed artifacts. You can filter the list by phase.

Two exports are available. Evidence Report opens a report page. Export JSON downloads the file cra-evidence-package.json.

The checklist is free on all plans. AI drafting of artifacts needs the Reporting plan or higher.

Applicability by organizational role​

The Cyber Resilience Act creates distinct obligations for different supply-chain roles. Configure your roles under Settings.

Select one or more roles from the five defined under Article 3.

  1. Manufacturer (Article 3(13)). Develops or markets products under its own name or trademark.
  2. Importer (Article 3(16)). Places products from outside the European Union on the market.
  3. Distributor (Article 3(17)). Makes products available on the market without modification.
  4. Open Source Software Steward (Article 3(14)). Provides sustained support for open-source development.
  5. Authorised Representative (Article 18). Acts under written mandate for a non-EU manufacturer.

When an organization holds several roles, the portal applies the most demanding status across all held roles. The precedence order is required, then verify only, then recommended, then optional, then not applicable.

Under Article 21, importers and distributors who place products under their own trademark or make substantial modifications assume all manufacturer obligations. The portal includes an explicit Article 21 question that adds the manufacturer role when answered yes.

Non-applicable sections leave the readiness denominator completely. A distributor does not build products, so SBOM and SDLC obligations are marked not applicable.

Implementation roadmap​

The Readiness page displays the OpenChain implementation roadmap. The roadmap provides a structured thirteen-phase schedule toward complete CRA readiness.

The PRIORITY row targets 11 September 2026 as a statutory deadline for Article 14 notification procedures. All subsequent phases provide relative target windows anchored to your organization start date.

Phase completion is calculated directly from your control register rows. When you update controls in your register, roadmap progress updates automatically.

Checklist items are adapted from the OpenChain CRA Compliance Checklist (Release Candidate 1, 19 August 2026), under CC BY 4.0. Completing checklist items does not constitute a formal conformity assessment or an EU Declaration of Conformity.