The CRA for small manufacturers and SMEs

What is the same regardless of company size

Scope is a property of the product, not of the manufacturer. If a product with digital elements is placed on the EU market, the essential cybersecurity requirements, the vulnerability handling obligations, the support-period commitment, the conformity assessment route implied by the product's classification, CE marking and the reporting duties all apply in full. A five-person company selling a connected sensor carries the same substantive obligations as a multinational selling the same class of device.

That also means the classification question matters as much for a small manufacturer as for a large one: whether a product falls into the default category or into the important or critical categories determines whether self-assessment is available or a third party must be involved.

Where the regulation acknowledges size

• Simplified technical documentation: the CRA provides for a simplified form of technical documentation for microenterprises and small enterprises, to be specified by the Commission, covering the same substance in a lighter format.
• Support obligations: Member States are required to support SMEs with awareness activities, training, guidance and access to testing environments, and to take SME interests into account when setting fees for conformity assessment.
• Proportionality of measures: the essential requirements are risk-based. Measures must be appropriate to the risks of the specific product, so a low-complexity product with a narrow interface does not require the control set of a network security appliance.
• Penalty setting: authorities are directed to consider the size and market share of the economic operator when deciding administrative fines.

None of these are exemptions. They reduce the cost of demonstrating conformity; they do not reduce the requirement to be conformant.

A sequencing that works with a small team

• Fix scope first. Determine per product line whether the CRA applies and which category it falls into, and write down the reasoning with the evidence you relied on. Everything downstream depends on this and it costs the least to get right.
• Automate the SBOM. Generate it in the build pipeline from the real dependency graph. A manually maintained component list is the first artefact to drift in a small team.
• Stand up vulnerability intake before writing policy. A monitored contact address, a triage log and a defined decision owner give you an operating process; the written procedure can then describe what actually happens.
• Make the update path real. Decide how a security fix reaches a deployed unit, and test that path once end to end. This is the obligation small manufacturers most often discover late, because it can require hardware or business-model changes.
• Build the risk assessment around the product's actual interfaces, not a generic template, and let it justify the design decisions you already made or now need to make.
• Assemble technical documentation incrementally as the above produces artefacts, rather than as a project at the end.

The commercial reality for suppliers

Many small manufacturers supply components into larger OEMs. In practice, contractual pressure arrives earlier than the regulatory deadline: integrators need conformity evidence, SBOMs and support commitments from their suppliers in order to make their own claims. Small suppliers that can hand over a clean SBOM, a documented vulnerability process and a stated support period tend to be treated as lower-risk suppliers, which is a commercial argument for doing the work early rather than a compliance one.

Common mistakes

• Assuming an SME exemption exists. It does not; only documentation format and support measures are adapted.
• Committing to a support period in marketing material before checking whether the toolchain, third-party dependencies and hardware can be maintained for that long.
• Treating open-source dependencies as someone else's responsibility once they are integrated into a commercial product.
• Delaying scope classification until the harmonised standards are final, which compresses the remaining engineering work into the last year.

Frequently asked questions