cra-readiness

name: cra-readinessdescription: Use when a company that sells software, connected devices or firmware in the EU asks whether the Cyber Resilience Act (CRA, Regulation 2024/2847) applies, has to report an actively exploited vulnerability or security incident under Article 14 (24h/72h deadlines, ENISA Single Reporting Platform), must classify products as important or critical, pick a conformity route or support period, check an SBOM, or get to CE marking by December 2027. Four deterministic scripts with cited articles.argument-hint: "[product inventory CSV | event log CSV | Annex I assessment CSV | SBOM JSON]"license: MITmetadata:   version: 1.0.0  build_pattern: "Four deterministic stdlib scripts with blocking exit codes (scope + class + route classifier, Article 14 reporting clock, Annex I/II/VII completeness gate, SBOM floor check); every rule cites Regulation (EU) 2024/2847, checked against the Official Journal text, Implementing Regulation (EU) 2025/2392 and Commission guidance C(2026) 5252"  distinct_from: "eu-ai-act-specialist (AI Act); information-security-manager-iso27001 and isms-audit-expert (management systems, not product law); mdr-745-specialist (medical devices, which the CRA excludes); cmmc-readiness (US defence); compliance-os (multi-framework orchestration without CRA)"

CRA Readiness

Portability: 4 stdlib scripts, no network, nothing submitted anywhere. Fill CSVs, run, keep the output with the technical documentation. Not legal advice and not a conformity assessment. The manufacturer signs the declaration; on routes B+C and H a notified body decides.

The CRA has two clocks. Article 14 reporting has applied since 11 September 2026 to every in-scope product on the EU market, including ones shipped years ago. Everything else applies from 11 December 2027 (Art 71(2)). Teams fail in predictable ways: nobody can say when they became "aware", class I products are planned on self-assessment while no harmonised standard is cited, a five-year support period is set for a router people keep for eight, and the SBOM lists packages but not what the product depends on.

Workflow

# 1 - Scope: which products, which class, which route, which CSIRT?
python scripts/cra_scope_classifier.py --inventory assets/inventory.example.csv
# 2 - Report: is any Article 14 report due or overdue right now?
python scripts/art14_report_clock.py --events assets/events.example.csv
# 3 - Conformity: can we sign the EU declaration of conformity?
python scripts/annex_i_gap_check.py --assessment assets/assessment.example.csv
python scripts/sbom_check.py --sbom assets/sbom.example.cdx.json

Run step 2 first whenever a vulnerability or incident is live: it is the only step with a 24-hour deadline. --list-categories, --list and --template print the Annex III/IV categories and the 39 assessment ids.

The gates block on (exit 4)

1. A conformity route the class does not allow (class I on module A without full harmonised standards; class II or critical on A) — Art 32.
2. A support period under five years when the product is used for five or more — Art 13(8).
3. No Member State to route Article 14 reports to — Art 14(7).
4. An Article 14 report past its deadline, or an event with no recorded awareness time — Art 14(2), 14(4).
5. An Annex I requirement NOT MET, or NA on one that applies to every product (all of Part II) — Annex I.
6. An SBOM that is not CycloneDX/SPDX JSON, names no product, or has no top-level dependencies — Annex I Part II(1).

Hard rules

• Unassessed is not MET. The gap check refuses a file that skips any of the 39 ids.
• The clock runs from awareness, and you prove awareness. No timestamp means the clock runs from detection.
• Legacy is not exempt from reporting. Products placed before 11 Dec 2027 owe Article 14 even unmodified, and after their support period ends (Art 69(3); Commission guidance).
• Late is still owed. Micro and small enterprises escape fines for a missed 24-hour early warning (Art 64(10)(a)), not the report.
• Cite the article. Every class, route and deadline call names its paragraph; borderline categories go to the notified body or authority, with Implementing Regulation (EU) 2025/2392 open.
• Never submit for the user. The scripts prepare; a named person submits on the SRP and signs the declaration.

Scripts

All support --help, --sample and --output json.

References and assets

• references/reporting_article14.md — dates, triggers, the three clocks, CSIRT routing, legacy products, penalties (7 sources)
• references/scope_classes_and_routes.md — scope and exclusions, roles, Annex III/IV, Art 32 routes, support period (6 sources)
• references/essential_requirements_and_evidence.md — every Annex I/II/VII item with typical evidence, retention periods, standards status (8 sources)
• assets/article14_runbook.md — standing set-up and per-event record for the SRP
• assets/inventory.example.csv, assets/events.example.csv, assets/assessment.example.csv, assets/sbom.example.cdx.json — input formats