- CRA reporting from 11 September 2026: what, to whom, and by whenArticle 14: the 24-hour early warning, the 72-hour notification and the final report.
- What “actively exploited” means, and where KEV and EPSS fitKnown is not exploited. How CISA's KEV catalogue and FIRST's EPSS score relate to the CRA's trigger.
- SBOM requirements under the CRA (and BSI TR-03183-2)What Annex I asks for, what the German technical guideline adds, and who gets to see your SBOM.
- A CRA timeline for small software makersThe dates that matter, from entry into force to December 2027, and what applies to products already on sale.
- Open-source stewards vs manufacturers under the CRAWho counts as a manufacturer, who is a steward, and what each has to do.
Each guide is checked against the regulation's text in the Official Journal and the European Commission's, ENISA's and BSI's own pages, and dated. Not legal advice.