CRA Compliance
EU Cyber Resilience Act
The Cyber Resilience Act (Regulation (EU) 2024/2847) applies to any product with digital elements placed on the EU market, wherever it is made.
Reporting obligations under Article 14 apply from 11 September 2026; the Regulation applies in full from 11 December 2027.
Rock Korea supports Korean manufacturers through scope assessment, gap analysis against the Annex I essential requirements, and the technical documentation the CRA requires.
Does the CRA apply to your product?
Five questions decide whether the CRA applies and, if it does, which class the product falls in. The class is what determines your conformity assessment route, so it is the first thing to settle. Everything is evaluated in your browser.
Three things the CRA asks of you
Compliance work falls into three blocks. Rock Korea supports all three.
-
Determine scope and class
Whether the CRA applies at all, and whether the product falls under Annex III class I or II, or Annex IV. The class decides which conformity assessment route is open to you.
-
Meet the essential requirements
Annex I Part I covers the product's security properties; Part II covers vulnerability handling, including a machine-readable SBOM. Everything is evidenced in the technical documentation and kept for ten years.
-
Report under Article 14
An actively exploited vulnerability means an early warning within 24 hours, a notification within 72, and a final report. Registration on ENISA's Single Reporting Platform has to be done in advance.
Guides and analysis
Free to use, no registration. Your SBOM never leaves the browser.
How to produce the SBOM Annex I requires, how the 24/72-hour clocks actually run, and a 43-item checklist of manufacturer obligations with their clauses.
Read the guides Analyzer SBOM Vulnerability AnalyzerDrop in an SBOM to cross-reference every component against known vulnerabilities and end-of-life status, and generate a report for the technical file.
Open the analyzerWhere Rock Korea comes in
The tools tell you what is in your product. Deciding what it means, and evidencing it, is the work the CRA holds the manufacturer accountable for.
- Gap analysis against the Annex I essential requirements, reusing what your existing ISMS-P or ISO 27001 certification already covers
- Technical documentation and the EU declaration of conformity, prepared to survive market surveillance
- Vulnerability handling procedures, coordinated disclosure policy, and Article 14 reporting readiness
- Exploitability assessment — the judgement the manufacturer is legally accountable for