How do manufacturers comply with the Cyber Resilience Act?

• Classify each product line: default, important or critical.
• Document the risk assessment and keep it current for the product version.
• Implement essential requirements and record the design decisions they drove.
• Automate SBOM generation in the build pipeline.
• Operate vulnerability intake, triage, coordinated disclosure and free security updates.
• Define and publish the support period and the update mechanism.
• Complete conformity assessment via the route the classification requires, then CE mark.

The order matters. Scope and classification decide which route and which evidence are needed, so doing them last is what compresses the engineering work into the final year.