A manufacturer can manage most Cyber Resilience Act documentation in spreadsheets, because no CRA provision requires compliance software. Spreadsheets break on the machine-readable SBOM, the 24-hour Article 14 early warning and component monitoring across the support period.
Key takeaways
- Regulation (EU) 2024/2847 sets the content of each CRA document and prescribes no compliance software.
- Product classification, the risk assessment, the Annex I applicability table and the technical documentation index fit in a spreadsheet.
- The CRA software bill of materials must use a commonly used and machine-readable format, which in practice means SPDX or CycloneDX.
- A spreadsheet sends no alert, and Article 14 requires an early warning within 24 hours of awareness of an actively exploited vulnerability.
- A compliance tool records and times the CRA processes, and the manufacturer must put those processes in place first.
Does the CRA require compliance software?
The CRA does not require compliance software. Regulation (EU) 2024/2847 sets what each document must contain and leaves the choice of tool to the manufacturer.
Article 31 and Annex VII list the content of the technical documentation. Article 13(7) asks the manufacturer to document cybersecurity aspects in a manner that is proportionate to the nature of the product and its risks. Article 33(5) lets microenterprises and small enterprises provide the Annex VII elements in a simplified format, which the Commission specifies by implementing act.
The only format rule is for the software bill of materials. Annex I Part II point (1) requires the SBOM in a commonly used and machine-readable format.
Which CRA duties fit in a spreadsheet?
Five CRA duties fit in a spreadsheet, because each one is a decision or a record that a person keeps up to date by hand. Three duties need a machine format, a timer or a vulnerability feed.
| Duty | CRA reference | Spreadsheet enough | Reason |
|---|---|---|---|
| Product classification | Articles 7 and 8, Annexes III and IV | Yes | One decision per product, reviewed when the core functionality changes |
| Cybersecurity risk assessment | Article 13(2), (3) and (7) | Yes | A risk register, updated during the support period, also when new vulnerability information changes a risk between releases |
| Annex I applicability | Article 13(4), Annex I Part I | Yes | A table with a clear justification for each requirement that does not apply |
| Technical documentation index | Article 31, Annex VII | Yes | An index of documents, kept for 10 years or for the support period, whichever is longer, under Article 13(13) |
| EU Declaration of Conformity | Article 28, Annex V | Yes | A signed document with a fixed model structure |
| Software bill of materials | Annex I Part II point (1) | No | The format must be machine-readable |
| Vulnerability handling | Article 13(8), Annex I Part II point (2) | Small scale only | Each component must be checked against new vulnerabilities for the whole support period |
| Article 14 reporting | Article 14(2) | No | The early warning is due within 24 hours of awareness |
The free EU Declaration of Conformity template and the other CRA templates cover the documents in the top five rows.
Where does a spreadsheet break?
A spreadsheet breaks where the CRA asks for a machine format, a time limit or continuous monitoring. Each of the three duties below has a concrete test.
The software bill of materials
Annex I Part II point (1) requires an SBOM in a commonly used and machine-readable format that covers at least the top-level dependencies. A list of component names in a spreadsheet does not meet that format. SPDX and CycloneDX meet it. The free SBOM validator checks a CycloneDX or SPDX JSON file against BSI TR-03183-2, the German guideline that makes the CRA SBOM requirement concrete.
The Article 14 clock
Article 14(2) sets three deadlines for an actively exploited vulnerability. The early warning is due within 24 hours of awareness. The vulnerability notification is due within 72 hours. The final report is due no later than 14 days after a corrective or mitigating measure is available.
Article 14 has applied since 11 September 2026. The CRA counts the hours from awareness and makes no exception for weekends or public holidays. A spreadsheet records a date, and it alerts nobody when a report arrives on a Friday evening. The free Article 14 timeline calculates the three deadlines from one awareness time. The Article 14 explainer gives the awareness test in full.
Monitoring across the support period
Article 13(8) requires effective vulnerability handling for the support period. The support period is at least five years, unless the product is expected to be in use for a shorter time.
Each release can change the component list. A manufacturer with 3 products and 4 releases a year has 60 releases by the end of a five-year support period. Each release in the field has an SBOM to check against new CVE and EUVD entries. A spreadsheet holds the component list, and a vulnerability feed must do the checking.
When does a spreadsheet cost more than a tool?
A spreadsheet has no licence cost and a staff cost that grows with each product, release and support year. Three signs show that the staff cost is higher than a tool would be.
- A person checks SBOMs against new vulnerabilities by hand every week.
- The Article 14 escalation depends on one person who reads one inbox.
- A market surveillance authority or a customer asks for a document, and the answer takes days to collect.
What is a CRA compliance platform and what does it replace? lists the six manual artifacts that a platform replaces. The PERT cost estimate for Article 14 gives the staff effort for the reporting duty alone. The pricing page gives the tool cost to compare against.
What must exist before any tool?
A monitored security contact, a coordinated vulnerability disclosure policy, a patch process and a named Article 14 reporter must exist before any tool. A tool records and times these processes, and people run them.
Annex I Part II point (5) requires a policy on coordinated vulnerability disclosure. Annex II point 2 requires the product to come with the single point of contact for vulnerability reports. An RFC 9116 security.txt file is one public form of that contact.
Few manufacturers publish one yet. In Wave 2 of the CRA Exposure Study, 33 of 342 measured EU manufacturers published a valid security.txt file on 16 September 2026, a share of 9.6%. A manufacturer can run a disclosure route that the scan cannot see, and the study methodology records that limit.
Put four processes in place before choosing a tool.
- A security contact that a named person reads every day, weekends included.
- A published coordinated vulnerability disclosure policy. The free CVD policy generator drafts one.
- A patch process that provides security updates separately from functionality updates, where technically feasible, as Annex I Part II point (2) requires.
- A named person, with a deputy, who files Article 14 notifications on the ENISA single reporting platform.
Where do free control libraries help?
Free control libraries cover part of the CRA. Of the 25 CRA requirements in the CRA, NIS2 and NIST SSDF crosswalk that CVD Portal published on 17 October 2026, 9 have a direct NIST SSDF 1.1 counterpart, 11 have a partial one and 5 have none.
A team that already follows SSDF can reuse that evidence for the secure development and vulnerability handling requirements. Both Article 14 reporting rows have no SSDF counterpart, because the reports go to EU authorities about a product on the EU market.
Organisation-level compliance platforms collect evidence for frameworks such as SOC 2 and ISO 27001. The comparison pages show where per-product CRA work sits next to them.
What is the next step?
Start with the duties that fit in a spreadsheet, and put the three that do not on a tool or a process.
- Classify each product with the free product classifier.
- Draft the documents from the free CRA templates.
- Validate each SBOM with the free SBOM validator.
- Open the disclosure channel with a free CVD Portal account, which includes the public submission portal and acknowledgment tracking.
- Compare the Article 14 reporting workflow and the SBOM monitoring on the pricing page.
Sources
Regulation (EU) 2024/2847 has the CELEX identifier 32024R2847.
- Regulation (EU) 2024/2847, Article 7
- Regulation (EU) 2024/2847, Article 13
- Regulation (EU) 2024/2847, Article 14
- Regulation (EU) 2024/2847, Article 28
- Regulation (EU) 2024/2847, Article 31
- Regulation (EU) 2024/2847, Article 33
- Regulation (EU) 2024/2847, Annex I
- Regulation (EU) 2024/2847, Annex II
- Regulation (EU) 2024/2847, Annex VII
- BSI TR-03183-2, Software Bill of Materials
Frequently asked questions
Does the Cyber Resilience Act require compliance software?
Regulation (EU) 2024/2847 does not require compliance software. The regulation sets the content of the technical documentation, the risk assessment and each Article 14 report. The only format rule is for the software bill of materials, which must be in a commonly used and machine-readable format.
Which CRA duties fit in a spreadsheet?
Product classification, the cybersecurity risk assessment, the Annex I applicability table, the technical documentation index and the record of the EU Declaration of Conformity fit in a spreadsheet. Each is a decision or a record that a person keeps up to date by hand, including when new vulnerability information changes a risk during the support period.
Where does a spreadsheet fail for CRA compliance?
A spreadsheet fails at three CRA duties. The software bill of materials must be machine-readable, which in practice means SPDX or CycloneDX. Article 14 requires an early warning within 24 hours of awareness of an actively exploited vulnerability. Components must be checked for new vulnerabilities for a support period of at least five years.
Does a compliance tool put the CRA processes in place?
A compliance tool records and times the CRA processes. The manufacturer must still run a monitored security contact, a coordinated vulnerability disclosure policy, a patch process and a named person who files Article 14 reports.