CRA Reference

Pre-market checklist

Primary audience:LegalDeadline:

Published on

To print, complete in the conformity review session, sign and archive with the technical documentation. No point may remain open when the marking is affixed.

Product: ______________________ Exact version: ______________________

Review date: ____________ Planned market entry: ____________

Scope and classification

  • 1. The product is qualified as a PDE; the qualification sheet is signed and filed. → Scope
  • 2. Exclusions have been examined and ruled out, or a reasoned exclusion sheet exists. → Exclusions
  • 3. The criticality class is determined and justified by a co-signed classification sheet. → Classes

Conformity route

  • 4. The assessment route is chosen and documented; where a notified body is required, it is engaged and its certificate is in the file. → Assessment

Essential requirements

  • 5. The cybersecurity risk assessment is carried out, dated, signed, and justifies the requirements ruled out.
  • 6. The applicable Annex I, Part I requirements are covered; the traceability matrix is complete. → Product security
  • 7. The Annex I, Part II vulnerability handling process is operational and documented. → Vulnerability handling

Bill of materials and disclosure

  • 8. The SBOM for this exact version is generated, validated above the quality threshold, signed and archived. → SBOM
  • 9. The coordinated disclosure policy is published and the contact point is live and tested. → Disclosure policy

Life cycle and information

  • 10. The support period is determined, justified in the file, approved by executive management and communicated to the buyer to the month. → Support
  • 11. The Annex II information and instructions to the user are drafted, translated and shipped with the product. → User information

File and declaration

  • 12. The Annex VII technical documentation is complete; its version is frozen and referenced. → Technical documentation
  • 13. The Annex V EU declaration of conformity is drawn up, accurate and signed by an authorised person. → Declaration

Operational

  • 14. The 24 h / 72 h / 14 d reporting procedure is in place, the on-call rota is designated and the channel has been tested for this product. → Reporting
  • 15. Ten-year archiving is configured for every item, and retrieval has been tested. → Retention

Decision

  • Authorisation to affix the CE marking and place the product on the market.
  • Refused — reasons and remediation deadlines:

Accepted reservations (open points, with owner and resolution date):

Role Name Signature Date
Legal department
CISO
Product management

Reminder. This checklist is not paperwork: it is the record that will demonstrate, in an inspection, that conformity was verified before placing on the market. A signed checklist with boxes ticked incorrectly is more damaging than an honest one carrying reservations.