Taking a Product Through CRA Compliance in the New Dashboard
Audience. The person who owns CRA compliance for a product, in a workspace that uses the new dashboard.
Outcome. One product is added and goes through all six stages. It is classified, risk-assessed, checked against Annex I, backed by evidence, declared conform and kept under review.
Why it matters. Every product with digital elements needs its own classification, risk assessment and conformity route under the CRA. The full obligations apply from 11 December 2027. The stage bar on each product shows which stage is next and what blocks the later ones.
Time required. Classification takes minutes. The risk assessment, the requirements and the evidence take days to weeks for each product.
Applies to. The new dashboard. To use it, switch on New interface in the top bar. For the classic dashboard, use SOP-02.
The flow at a glance
The diagram shows the six stages on one page, from a new product to a product that stays compliant. The steps below explain each part. Select the diagram to open it at full size. The example product is fictional.
Step 0. Find the product and read its stage bar
Open Products. The table shows each product with its technical file progress, criteria passed, evidence and next action.
Each product that is not complete also has a row under Needs attention now on the Overview, in the Products group. Next step on the row opens the product at its current stage.
Open the product. The page shows the classification and the stage bar. Export checks and progress below the stage bar opens the technical file readiness checks and the work completed. The tabs follow. Each stage has a tab with the same name.
The markers mean the same as on a report. A tick is done. The number in a bold outline is current. A grey lock is blocked, with the reason below it. A grey number is to do. "Agent drafts, you approve" means the portal drafts the content and you check it. "Suggested, you decide" shows on Classify. The suggestion matches words in the product name and description. It does not come from an AI model.
A Member sees the Requirements and Keep compliant stages without a link, marked "Admin only". An Admin does those two stages.
Step 1. Add the product
Adding the product is not a stage in the stage bar. Steps 2 to 7 follow the six stages.
To add a product, go to Products and click "Add product". Select one of the three ways below. Only an Admin can add a product.
- Blank product. Enter the "Product name" and a "Short description". Then click "Add product". The description helps the portal suggest a classification.
- From a document. Upload or paste a datasheet, manual or security document. The portal detects the name and pre-maps the document to CRA controls.
- From an industry template. Select a template. The template adds a starter asset inventory, threats and risk criteria.
Open the Classify tab and complete Product description.
Done when. The product is in the Products list. Its stage bar shows Classify as the current stage.
Step 2. Classify
On the Classify tab, go to CRA classification (Annex III / IV).
- Select the Annex III or Annex IV category, or the default category. If the portal has a suggestion, check it. The suggestion matches words in the name and description, so read its scope test. The stage then shows "Suggested, you decide".
- Read Check this applies under the category. It says what the category covers and what it does not cover.
- Read the conformity route. Important Class II and Critical products need a notified body or a European cybersecurity certification scheme. Module A self-assessment is not open to them.
- Under Security standards applied, tick only the standards the product was built or tested against.
- For an Annex III or Annex IV category, write the Classification basis. The portal does not save the category without it.
- Click Save classification. Saving confirms the classification and records the decision date. The audit log records who saved it.
Done when. The classification is saved.
Step 3. Context and risk
On the Context and risk tab, work through the Clause 6 sections in the order of the numbered links at the top of the tab. The stage links to the first missing artifact.
- Product context (Clause 6.2). Describe the interfaces, users and functions. Use Start from a document to draft from existing documents, then Fill the assessment to add its assets and remote systems.
- Risk assessment. Record assets, data-flow diagrams and the threat model. The portal drafts the STRIDE threat model for you to check. AI threats show their reasons, including the basis, assumptions and rationales.
- Risk register. Record each risk and its treatment. The Annex II sheet lists confirmed risks only.
- Clause artifacts (6 and 7). This section is on the Requirements tab, which only an Admin sees. Review each drafted Clause 6 artifact and complete it.
Done when. Every Clause 6 artifact is complete, every Clause 6 criterion has passed and no export check for the Context and risk tab is open.
Blocked when. The product is not classified.
Step 4. Requirements
Open the Requirements tab. This stage is for Admins only.
- If the checklist shows Blocked, open the Context and risk tab and record the applicability decision for each Part I(2) requirement first.
- For each Annex I requirement, record how the product meets it. Assign an owner and a target date.
- Attach evidence and sign off each requirement. The counter shows how many are signed off and how many have evidence.
Done when. Every Clause 7 artifact is complete, every criterion has passed and no export check for the Requirements tab is open. That check clears when one applicable requirement is signed off. A sign-off on a requirement marked not applicable does not count. Sign off every requirement that applies, because the technical file reads "Incomplete" until you do.
Blocked when. Context and risk is not done.
Step 5. Evidence
Open the Evidence tab.
Each CRA control shows Ready or Not ready. To make a control ready, attach a note or a document to it with Add evidence, then accept it. Set how long the evidence stays valid if it expires. Click Show only the N not ready to list only the gaps. N is the number of controls not ready.
Done when. Every control is ready. The two conformity documents at the end of the list show "Generated" and do not count, because the Conformity step makes them.
Step 6. Conformity
Open the Conformity tab.
- Under Export review, submit the technical file for review. An Admin approves or rejects it. Tick Require approval before export to make this review mandatory. The Admin who submits can approve their own review, unless Require a second admin to review is ticked. Approve stays off until every export check passes. The panel lists the open checks next to it. Reject is always available.
- Under Conformity documents, check the manufacturer on the declaration. Click Use a different manufacturer only when you prepare the file for a client.
- If the conformity route needs a notified body, enter its name, its 4-digit identification number and the certificate number. Under Procedure the body performs, choose Module B + C, Module H or European cybersecurity certification. The list shows only the procedures that the route of the product permits. Click Save notified body. Point 7 of the declaration then names the body, its number, the procedure and the certificate. The export stays blocked until the name, the number and the procedure are recorded. The certificate number can follow later. Each value that is missing stays a placeholder in brackets that names the value.
- Read the drafts under Conformity documents. The portal builds the EU Declaration of Conformity (Annex V), the simplified declaration (Annex VI) and the technical documentation index (Annex VII) from the saved record when the product page loads and again after each save. Click Regenerate if a draft does not show a recent change.
- Under Place on the market, the last card on the tab, click Capture snapshot. Only an Admin sees the card. The snapshot records the state of the assessment when the product is placed on the market. It refuses while an export check is open, while the record has a contradiction, while an applicable Annex I requirement has no sign-off or no evidence, or while no support period in months is recorded. The export needs only one requirement signed off and one evidenced. The snapshot needs all of them.
The generated documents are drafts with placeholders. Do not issue them without review. An unclassified product has no route in the declaration.
The drafts are a live view and are not stored. Capture snapshot keeps a fixed copy.
Done when. A snapshot exists and no export check is open. When Require approval before export is ticked, an approved review must also match the current file.
Blocked when. Requirements or Evidence is not done. The note names the stage to finish first.
Step 7. Keep compliant
Open the Keep compliant tab. This stage is for Admins only.
- Under Periodic documentation review, check the review cadence. The review clock starts at the first snapshot.
- When something changes, record it under Monitoring and review. Select the trigger type and click Record trigger. The portal also records some triggers itself, for example a new CVE in a component of your SBOM.
- When you review the documentation, tick the triggers the review addresses and click Mark review complete.
Vulnerabilities found in the product go through the report workflow. Use SOP-10 for them.
Done when. Conformity is done, no trigger is open and the next review is not overdue. This stage can return to current at any time, when a new trigger opens or a review falls due.
Blocked when. Conformity is not done.
Completion checklist
Per product.
- Product added with a description
- Classification saved, with the conformity route read and understood
- All Clause 6 artifacts complete, including the risk assessment and risk register
- Annex I checklist signed off, with all criteria passed
- All controls ready on the Evidence tab
- Notified body and its procedure recorded, where the route needs one
- Conformity documents generated, reviewed and completed
- Snapshot captured
- Review cadence set and open triggers closed