Cyber Resilience Act checklist, one line per product
A Cyber Resilience Act compliance checklist works per product, not per company: the class the function points to, the route it asks for, the reporting process, the support period, passwords, updates, the SBOM. Download the columns as a CSV, fill it in, one line per product, then paste it back and the finder reads it. The list you already keep works too: a column the finder cannot find is reported as not recorded.
Columns the finder reads
header names are matched loosely| Column | What goes in it | Needed |
|---|---|---|
| Product | the SKU, model or product name | required |
| Function | what it does, in the words your catalogue uses: smart meter gateway, 4G router, indoor IP camera, asset tracker | required |
| Markets | EU, UK, US-California or other; blank reads the company defaults | required |
| Sold to | consumers, businesses or both; PSTI turns on it | for UK |
| Role | manufacturer, importer, distributor or own brand | advised |
| Default password | unique per device, set by user at first use, universal, none or unknown | strongly advised |
| Updates | signed automatic, signed manual, unsigned, none, or none (no software) | strongly advised |
| Support period | in years, or an end date | strongly advised |
| Vulnerability contact | yes or no: a published address for reporting vulnerabilities | advised |
| Reporting process | yes or no: a process to notify actively exploited vulnerabilities and severe incidents | strongly advised |
| SBOM | yes, no or partial | advised |
| Conformity route | self-assessment, harmonised standard, notified body, EU certification or none yet | strongly advised |
| EU authorised representative | yes or no, where the manufacturer is outside the EU | for non-EU makers |
| PSTI statement | yes or no: a statement of compliance travels with the product | for UK consumers |
| Placed on market | the date the model was first placed on the market | advised |
| Still on sale | yes or no | advised |
| Notes | anything else, as a short label; a cell over 300 characters is removed | optional |
A first line for the company
role: manufacturer | markets: EU, UK, US-California | manufacturer outside EU: yes | vulnerability reporting process: no | as at: 2026-09-26
The markets and role are defaults a line's own column overrides; the company-wide reporting answer covers any line whose reporting column is blank; the as-at date is the one the timing diagram and the reporting note read against.
The four rows in the CSV
invented| Product | Function | Markets | Support period | Conformity route |
|---|---|---|---|---|
| SM-400 | smart electricity meter | EU, UK | 10 years | self-assessment |
| GW-2 | smart meter gateway | EU | 10 years | notified body |
| Cam-1 | indoor IP camera | EU, UK, California | 5 years | harmonised standard |
| TR-9 | asset tracker with satellite Bluetooth | EU, UK | 7 years | self-assessment |
Fill it in, paste it back: each line comes back with the class its declared function points to, the duties where you sell it and the notes, and the CSV export adds an owner and a due date column for each gap.