Guides
Every claim here is checked against the primary source: the Official Journal text of Regulation (EU) 2024/2847, and ENISA's own published material. Where the evidence is thin, the guide says so rather than filling the gap with confidence.
What actually happens on 11 September 2026
The Article 14 reporting obligation starts. Here is precisely what it requires, what it does not, and why most manufacturers over-estimate it.
Updated 27 July 2026
How to produce an SBOM when you have no source code
Your ODM will not give you source. Annex I Part II still requires an SBOM. Here is how binary analysis actually works and what it can and cannot tell you.
Updated 27 July 2026
Default, Important Class I, Class II or Critical: which are you?
The classification decides whether you can sign your own conformity paperwork or must pay a notified body. Here is the actual test, from Annex III, Annex IV and Article 32.
Updated 27 July 2026
How long is the CRA support period, exactly?
Five years is a floor, not a default. And the ten-year number people quote is a different obligation entirely.
Updated 27 July 2026