EU Cyber Resilience Act (CRA)

EU Cyber Resilience Act (CRA) — 86% of in-scope requirements covered.

13 requirements · 11 in scope (8 enforced · 3 designed) · 2 out-of-scope (outside KYE™’s authority layer). The 86% is weighted over the in-scope base.

EU Cyber Resilience Act (CRA): requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. 1 · enforced

    Article 14(1) — Manufacturer notifies any actively exploited vulnerability contained in the product to the…

    Audit events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1, kye.evidence.pack.v1 · Rule packs: kye:rule-pack:cyber-resilience-incident · Constitution: 13 resilience loop, 38 comms rail

  2. 2 · enforced

    Article 14(2) — Manufacturer notifies any severe incident having an impact on the security of the product to…

    Audit events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1, kye.evidence.pack.v1 · Rule packs: kye:rule-pack:cyber-resilience-incident · Constitution: 13 resilience loop

  3. 1 · enforced

    Annex I, Part I (1) — Products with digital elements designed, developed and produced to ensure an…

    Audit events: kye.purpose.admissibility.v1, kye.evidence.decision_map.v1 · Rule packs: kye:rule-pack:cyber-resilience-incident · Constitution: 12 purpose permission, 25 edge governance

  4. a · enforced

    Annex I, Part I (2)(a) — Products made available without known exploitable vulnerabilities

    Audit events: kye.evidence.decision_map.v1, kye.compliance.attestation.v1 · Constitution: 15 mcp and sdk

  5. d · enforced

    Annex I, Part I (2)(d) — Protect confidentiality, integrity and availability of data via state-of-the-art…

    Audit events: kye.audit.event.v1, kye.evidence.pack.v1 · Constitution: 30 audit worm retention, 31 data governance pack

  6. j · enforced

    Annex I, Part I (2)(j) — Record and monitor relevant internal activity, including access to or modification…

    Audit events: kye.audit.event.v1 · Constitution: 35 streaming logs, 30 audit worm retention

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Fully applicable 11 December 2027; the vulnerability-and-incident reporting obligation (Article 14) applies from 11 September 2026.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Conformity assessment, CE marking & market surveillance (Articles 13, 32, Annex VII)2010050%
Reporting of actively exploited vulnerabilities & severe incidents (Article 14)22000100%
Essential cybersecurity requirements — security-by-design (Annex I, Part I)44000100%
Vulnerability handling requirements (Annex I, Part II) + SBOM5220075%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
cra.A13.12Article 13(12) + Annex VII — Manufacturer draws up technical documentation (including the SBOM) and keeps it at the disposal of market-surveillance authorities for ten yearsdesignedaudit_events: kye.compliance.attestation.v1, kye.evidence.pack.v1
engines: internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
cra.A32Article 32 + Annex VIII — Conformity assessment of the product and affixing of the CE marking before placing on the marketout-of-scopeconstitution_refs: constitution/15-MCP-AND-SDK.md
cra.A14.1Article 14(1) — Manufacturer notifies any actively exploited vulnerability contained in the product to the CSIRT designated as coordinator and to ENISA (early warning ≤24h, notification ≤72h, final report ≤14 days)enforcedaudit_events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1, kye.evidence.pack.v1
engines: internal, internal
rule_packs: kye:rule-pack:cyber-resilience-incident
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/38-COMMS-RAIL.md
cra.A14.2Article 14(2) — Manufacturer notifies any severe incident having an impact on the security of the product to the coordinator CSIRT and ENISA, with the same staged timelineenforcedaudit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1, kye.evidence.pack.v1
engines: internal, internal, internal
rule_packs: kye:rule-pack:cyber-resilience-incident
constitution_refs: constitution/13-RESILIENCE-LOOP.md
cra.annex1.I.1Annex I, Part I (1) — Products with digital elements designed, developed and produced to ensure an appropriate level of cybersecurity based on the risks (security-by-design)enforcedaudit_events: kye.purpose.admissibility.v1, kye.evidence.decision_map.v1
engines: internal, internal
rule_packs: kye:rule-pack:cyber-resilience-incident
dictionaries: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/25-EDGE-GOVERNANCE.md
cra.annex1.I.2.aAnnex I, Part I (2)(a) — Products made available without known exploitable vulnerabilitiesenforcedaudit_events: kye.evidence.decision_map.v1, kye.compliance.attestation.v1
engines: internal
dictionaries: internal
constitution_refs: constitution/15-MCP-AND-SDK.md
cra.annex1.I.2.dAnnex I, Part I (2)(d) — Protect confidentiality, integrity and availability of data via state-of-the-art mechanisms; processed data limited to what is necessaryenforcedaudit_events: kye.audit.event.v1, kye.evidence.pack.v1
engines: internal, internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md, constitution/31-DATA-GOVERNANCE-PACK.md
cra.annex1.I.2.jAnnex I, Part I (2)(j) — Record and monitor relevant internal activity, including access to or modification of data, services or functions (security logging)enforcedaudit_events: kye.audit.event.v1
engines: internal, internal
constitution_refs: constitution/35-STREAMING-LOGS.md, constitution/30-AUDIT-WORM-RETENTION.md
cra.annex1.II.1Annex I, Part II (1) — Identify and document vulnerabilities and components, including by drawing up a software bill of materials (SBOM) in a commonly used machine-readable format covering at least the top-level dependenciesdesignedaudit_events: kye.evidence.decision_map.v1, kye.evidence.tool_call_pin.v1
engines: internal
constitution_refs: constitution/71-DOCUMENT-INTELLIGENCE-RAIL.md
cra.annex1.II.2Annex I, Part II (2) — In relation to the risks, address and remediate vulnerabilities without delay, including by providing security updatesenforcedaudit_events: kye.evidence.decision_map.v1, kye.signal.incident.opened.v1
engines: internal, internal
rule_packs: kye:rule-pack:cyber-resilience-incident
dictionaries: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
cra.annex1.II.3Annex I, Part II (3) — Apply effective and regular tests and reviews of the security of the productenforcedaudit_events: kye.compliance.attestation.v1
engines: internal
dictionaries: internal
constitution_refs: constitution/15-MCP-AND-SDK.md
cra.annex1.II.4Annex I, Part II (4) — Put in place and enforce a coordinated vulnerability disclosure (CVD) policydesignedaudit_events: kye.evidence.decision_map.v1, kye.comms.dispatched.v1
engines: internal
constitution_refs: constitution/38-COMMS-RAIL.md
cra.annex1.II.6Annex I, Part II (6) — Once a security update is available, disseminate it without delay and free of charge, with advisory messages informing users of required actionsout-of-scopeconstitution_refs: constitution/38-COMMS-RAIL.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.