Leadership

In one sentence

Without a software bill of materials and a documented vulnerability handling process, you will no longer be able to affix the CE marking to your digital products — and therefore no longer sell them in the European Union.

In three numbers

11 September 2026	Report an actively exploited vulnerability within 24 hours to ENISA and the coordinating CSIRT. Applies to products already on the market too.
11 December 2027	CE marking, technical documentation, SBOM, support period, user information: full application.
EUR 15 m or 2.5 %	Administrative fine ceiling for breaches of the essential requirements or the reporting obligations — the higher of EUR 15 million and 2.5 % of total worldwide annual turnover.

The five facts that drive the effort

1. The criticality class drives the cost. A default product self-assesses; an Important class II or Critical product requires a notified body, with a lead time of several months and limited market capacity. That is the critical path.
2. The support period commits you for five to ten years. It forces you to keep build chains alive, backport fixes and retain artefacts long after commercial end of life.
3. The reporting deadline has already passed, and it covers the legacy portfolio. It requires an on-call rota, not a project.
4. The CRA overlaps substantially with NIS 2, DORA and customer questionnaires. The effort is not wasted: it feeds those requirements too.
5. The SBOM has become a commercial argument. Large accounts and public buyers already ask for it; producing one meets an obligation and shortens sales cycles.

Decisions required from the committee

• Appoint an executive sponsor and approve the RACI matrix, in particular the three trade-offs listed in Organisation.
• Choose an investment scenario among the three described in Budget and resources, explicitly accepting the residual risk that goes with it.
• Authorise contracting with a notified body for products that cannot self-assess, without waiting for harmonised standards to be published.

Where you stand

Progress is tracked in Metrics: portfolio coverage, remediation intervals, residual exposure. The self-assessment re-measures it quarterly against a stable grid.