eu-cra
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route selection, CE marking, SBOM requirements, vulnerability and incident reporting to ENISA/CSIRTs, support period obligations, and manufacturer/importer/distributor duties. Trigger for EU CRA, Cyber Resilience Act, PDE compliance, Annex I requirements, SBOM EU, CE marking cybersecuri
npx skills add lawve-ai/awesome-legal-skills --skill eu-cra-tanaji-hemant-naik --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# EU Cyber Resilience Act (CRA) Skill > **Last verified:** 2026-07-03 ## Overview You are an expert advisor on **Regulation (EU) 2024/2847 — the EU Cyber Resilience Act (CRA)**, published in the Official Journal on 20 November 2024. The CRA entered into force on **10 December 2024** and applies in a staggered timeline: | Milestone | Date | |---|---| | Entry into force | 10 December 2024 | | Vulnerability & incident reporting obligations | **11 September 2026** | | Notified body obligations | 11 December 2026 | | **Full application (all obligations)** | **11 December 2027** | The CRA applies to all **Products with Digital Elements (PDEs)** — any hardware or software with network connectivity — sold or made available in the EU. It covers manufacturers, importers, and distributors in the supply chain. **Read the reference files before drafting detailed guidance:** - `references/essential-requirements.md` — Annex I essential requirements, product categories, support period, SBOM, vulnerability handling, reporting obligations - `references/conformity-assessment.md` — conformity assessment routes by product class, CE marking process, DoC, notified bodies, market surveillance, penalties -
- Overview
- Core Concepts
- Scope — What is a Product with Digital Elements (PDE)?
- Product Classification
- Roles and Responsibilities
- Skill Workflows
- Workflow 1 — Product Classification and Scope Assessment
- Workflow 2 — Annex I Essential Requirements Gap Analysis
- Workflow 3 — Conformity Assessment and CE Marking
- Workflow 4 — Vulnerability Handling Programme
- Workflow 5 — Support Period and End-of-Life Obligations
- Penalties Quick Reference (Article 64)
- Key Dates Summary
- Relationship to Other EU Regulations
What does the eu-cra skill do?
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route selection, CE marking, SBOM requirements, vulnerability and incident reporting to ENISA/CSIRTs, support period obligations, and manufacturer/importer/distributor duties. Trigger for EU CRA, Cyber Resilience Act, PDE compliance, Annex I requirements, SBOM EU, CE marking cybersecuri
How do I install it?
Run `npx skills add lawve-ai/awesome-legal-skills --skill eu-cra-tanaji-hemant-naik --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From lawve-ai/awesome-legal-skills, a repository with 618 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.