Secure by default
The product should not ship waiting for the buyer to turn security on.
Consumer electronics
Ready for the CRA's 24-hour report, and for your retailer's questions
A reporting runbook, named roles and one practice drill on your product, plus the CRA answers a retailer may ask you for.
Checked against the regulation on 16 Oct 2026 · What changed
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.
Support end date at purchase · Secure by default · Your brand may make you the manufacturer
The CRA for consumer electronics brands
The buyer is part of the duty
Consumer products have to say how long they will be supported, in a language the buyer can read.
For consumer electronics the duties that show up at the point of sale matter as much as the file you keep. The product is secure by default. Security updates can be automatic, and the buyer can opt out. The support end date is shown at purchase. User information in the buyer's language ships with the product.
If you sell hardware made by someone else under your own brand, you may be the manufacturer. Decide that first, because every other duty follows from it.
The duties that weigh most
What the buyer is shown, how updates arrive, and who the manufacturer is.
Automatic updates
Security updates can install on their own, with an opt-out for the buyer.
Support end date
The date support ends is shown at purchase.
Local languages
User information is in the languages the sale requires.
Your brand on the box
Selling under your own brand can make you the manufacturer, even if someone else built the hardware.
Reporting: applies since 11 Sep 2026 · Everything else: 11 Dec 2027 · Full timeline
What usually comes first
Decide the role you hold, then the date you will show the buyer.
Usually first
- Confirm whether you are the manufacturer.
- Name who reports an actively exploited vulnerability.
- Choose a support end date you can show at purchase.
Can follow
- The update path, automatic with an opt-out.
- SBOMs for the product and its suppliers.
- The technical file and declaration before December 2027.
Related
Questions
How does the price work?
One fixed price for your product, in writing, the same day you ask. It only changes if the scope does.
Do you see our real vulnerability data?
No. The drill runs on sample data. We sign an NDA or DPA before you share anything sensitive.
We already work with a test lab or consultant.
That's fine. We set up the reporting process and they keep the legal and assessment work.
We're outside the EU but sell there.
Article 14 applies to products on the EU market, wherever the maker is based.
Do devices we sold years ago count?
Yes for reporting. Article 14 covers products already on the market.
We rebrand products made elsewhere. Are we the manufacturer?
You may be. An importer or distributor that sells under its own brand, or substantially changes a product, takes on the manufacturer's duties. Your adviser confirms which role you hold. We build the records for the role you decide.
Does ETSI EN 303 645 help with the CRA?
It is a useful baseline for consumer IoT security and covers many of the same basics, such as no default passwords and a way to report vulnerabilities. It does not replace the CRA's own requirements or Article 14 reporting.
Samisoftz builds the process and software your team uses to organise CRA evidence and reporting. You stay responsible for meeting the regulation. We don't give legal advice, act as a notified body, or submit reports for you.
On a delivery date agreed in writing, your team will know who decides, what to send at 24 and 72 hours, and will have practised it once on your own product. The decision to report stays with you. We set up how.
Could your team send a 24-hour early warning tomorrow? Find out in 30 minutes.
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.