Legal path

This section does not redefine the Regulation — it translates it into obligations, evidence and control points that belong to Legal. Every page links to the canonical definition in The CRA framework.

Master table of obligations

Obligation	Legal basis	Deadline	Evidence expected	Page
Qualify the product as a PDE	Art. 2, 3	11/12/2027	Signed qualification sheet	Scope
Determine the criticality class	Annexes III, IV	11/12/2027	Classification sheet	Classes
Choose the assessment route	Art. 32, Annex VIII	11/06/2026	Notified body contract	Assessment
Compile the technical documentation	Annex VII	11/12/2027	Complete file, SBOM included	Technical documentation
Draw up the EU declaration of conformity	Annex V	11/12/2027	Signed declaration	Declaration
Affix the CE marking	Art. 30	11/12/2027	Conformity review record	CE marking
Report within 24 h / 72 h / 14 d	Art. 14	11/09/2026	Register + platform acknowledgements	Reporting
Determine and publish the support period	Art. 13, Annex II	11/12/2027	Register + statement to the buyer	Support
Provide information to the user	Annex II	11/12/2027	Notice shipped with the product	User information
Retain file and declaration	Art. 13, 31	11/12/2027	Evidence vault + audit log	Retention

What Legal must obtain from Cyber

• the SBOM, validated and signed, per product and per version, in the agreed format;
• the documented cybersecurity risk assessment;
• the vulnerability handling log and the VEX statements justifying uncorrected vulnerabilities;
• an operational coordinated disclosure policy with a live point of contact;
• security test reports;
• a description of the update distribution mechanism;
• the technical grounds for the support period chosen;
• in an incident, the “actively exploited” qualification, within two hours.

What Legal must supply to Cyber

• the regulatory classification of each product and the assessment route chosen;
• the licence policy and the list of prohibited licences;
• the supplier clauses negotiated and the commitments obtained;
• the decision on SBOM disclosure to customers;
• the decision to report and the approved wording;
• the support period committed contractually.

These exchanges, with deadlines and formats, are formalised in Legal ↔ Cyber interface.

The control point that matters

One thing must be non-negotiable on the Legal side: a formal right of veto over placing on the market until the fifteen points of the checklist are ticked. Without that gate, technical documentation gets assembled after the fact — which is exactly what market surveillance is looking for.