Most apps are “default category” under the Cyber Resilience Act — self-assessment, no external auditor. That makes compliance a checklist, not a project: ten documents, prepared in order, ahead of two dates. Tick them off as you go — progress is saved in this browser.
The calendar
In force
Omnibus price transparency (2019/2161) — show the lowest price of the prior 30 days with every discount.
In force
GDPR — personal data.
11 Sep 2026
CRA reporting begins — actively exploited vulnerabilities: early warning in 24 hours, notification in 72 hours, final report in 14 days.
11 Dec 2027
CRA full obligations — documentation, secure updates, conformity assessment, CE marking.
Same dates
Connected devices (Class I / II) — stricter conformity routes, identical clocks. If you sell anything with firmware, the device itself is in scope.
Your ten steps, in order
0 of 10 prepared
Firmware & hardware
For a connected device the SBOM must cover the firmware image, not just the companion app. Two ways to produce it, both landing in this registry:
Build-time
You build the firmware — the build system emits the SBOM as a build artifact: Yocto (create-spdx) or Zephyr (west spdx). Most accurate: it knows every recipe and version.
Binary
Vendor-supplied image, no sources — binary analysis reconstructs the inventory: EMBA (extract + identify, CycloneDX out) or cve-bin-tool (component signatures, SPDX/CycloneDX out). Best-effort by nature; state the method in the document.
Either way the document is pushed to this registry versioned per image, and vulnerability scans (Grype, Dependency-Track) run against the registry copy — that is the “stays current” half of the CRA row.