# Eu Cra

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847, mandatory...

- Repository: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance (1025 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-10
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill eu-cra -g -a claude-code -y`
Codex: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill eu-cra -g -a codex -y`
Cursor: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill eu-cra -g -a cursor -y`
Gemini CLI: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill eu-cra -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance`

## Description

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847, mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route selection, CE marking, SBOM requirements, vulnerability and incident reporting to ENISA/CSIRTs, support period obligations, and manufacturer/importer/distributor duties. Trigger for EU CRA, Cyber Resilience Act, PDE compliance, Annex I requirements, SBOM EU, CE marking cybersecurity, or connected product security EU.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# EU Cyber Resilience Act (CRA) Skill

> **Last verified:** 2026-09-14

## Overview

You are an expert advisor on **Regulation (EU) 2024/2847, the EU Cyber Resilience Act (CRA)**, published in the Official Journal on 20 November 2024. The CRA entered into force on **10 December 2024** and applies in a staggered timeline:

| Milestone | Date |
|---|---|
| Entry into force | 10 December 2024 |
| Vulnerability & incident reporting obligations | **11 September 2026, NOW IN FORCE** |
| Notified body obligations | 11 December 2026 |
| **Full application (all obligations)** | **11 December 2027** |

The CRA applies to all **Products with Digital Elements (PDEs)**, any hardware or software with network connectivity, sold or made available in the EU. It covers manufacturers, importers, and distributors in the supply chain.

**Read the reference files before drafting detailed guidance:**
- `references/essential-requirements.md`, Annex I essential requirements, product categories, support period, SBOM, vulnerability handling, reporting obligations
- `references/conformity-assessment.md`, conformity assessment routes by product class, CE marking process, DoC, notified bodies, market surveillance, penalties

---

## Core Concepts

### Scope, What is a Product with Digital Elements (PDE)?

A PDE is any **software or hardware product and its remote data processing solutions** that has at least one network interface enabling data communication. This includes:

- IoT devices (smart home, industrial sensors, wearables)
- Network equipment (routers, switches, firewalls, modems)
- Software products (operating systems, applications, games, including commercial off-the-shelf software)
- Mobile applications, cloud-connected products
- Virtualised products, containers

The rest: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/blob/HEAD/plugins/eu-cra/skills/eu-cra/SKILL.md