The Compliance Obligation Matrix
The Compliance Obligation Matrix lists the CRA vulnerability-handling articles and the artifacts that each article requires. Open CVD Readiness in the sidebar and select the Groundwork tab. The tab shows the matrix in two lists, Preparation and intake and Remediation and release. A switch at the top of the tab selects one. The full matrix is also at /settings/obligations.
Each artifact is one of two types.
- Portal artifact. The portal manages it for you. It counts when the portal holds its data. A row with no data says what is missing, for example "Not uploaded".
- Tenant artifact. Your team creates it. For each tenant artifact, you can tick a checkbox, add a note, and paste a URL to your evidence.
Readiness drills
18 portal rows need a vulnerability report that reaches their step. One of them, Assigned coordinator, is advice and leaves the count. Examples are "Communication with the reporter" and "Documented remediation plan". Before your first real report, a readiness drill shows that your team can do each step.
An admin selects Run a drill in the Readiness drill panel on the Groundwork tab. The drill opens as a report marked "Readiness drill". Work it like a real report. Each step you finish shows its rows, and a row then reads "Ready: shown by drill CVD-… on (date)".
| Step | Rows it shows |
|---|---|
| The drill opens | Vulnerability report, received reports with an identifier, information record, vulnerability information, tracked list |
| Assign a coordinator | Assigned coordinator |
| Score it with CVSS | Processing record, verified report, priority assessment, prioritised list, impacted software components (with an SBOM on file) and impacted hardware components (with hardware registered) |
| Record a remediation decision | Remediation decision and remediation plan |
| Message the reporter | Communication records |
| Draft an advisory | Published vulnerability information |
Drills stay out of report counts, SLA alerts, Article 14 deadlines and published figures. Escalation, upstream reports and advisory publishing refuse a drill. A drill sends no email, webhook, Slack or Teams message. The portal records the acknowledgement, the coordinator notice and each message to the reporter on the drill as "Readiness drill. Recorded in the portal only.", so the step still shows. One drill is open at a time. A real report that reaches a step always replaces the drill on that row.
The dashboard step "Run a readiness drill" replaces "Receive your first report". A test report filed through your public portal is not marked as a drill, so it counts as a real report.
The header shows your overall percentage and the number of completed artifacts. You can filter the list by phase.
Two exports are available. Evidence Report opens a report page. Export JSON downloads the file cra-evidence-package.json. The matrix, the report, the JSON file, the readiness pages and the dashboard count in the same way, so they show the same number.
The checklist is free on all plans. Template drafts of artifacts need the Reporting plan or higher.
Applicability by organizational role
The Cyber Resilience Act creates distinct obligations for different supply-chain roles. Configure your roles under Settings.
Select one or more roles from the five defined under Article 3.
- Manufacturer (Article 3(13)). Develops or markets products under its own name or trademark.
- Importer (Article 3(16)). Places products from outside the European Union on the market.
- Distributor (Article 3(17)). Makes products available on the market without modification.
- Open Source Software Steward (Article 3(14)). Provides sustained support for open-source development.
- Authorised Representative (Article 18). Acts under written mandate for a non-EU manufacturer.
When an organization holds several roles, the portal applies the most demanding status across all held roles. The precedence order is required, then verify only, then recommended, then optional, then not applicable.
Under Article 21, importers and distributors who place products under their own trademark or make substantial modifications assume all manufacturer obligations. The portal includes an explicit Article 21 question that adds the manufacturer role when answered yes.
Non-applicable sections leave the readiness denominator completely. A distributor does not build products, so SBOM and SDLC obligations are marked not applicable. The Evidence Report still lists such an article and marks it as not applicable to your roles.
Implementation roadmap
The Roadmap tab of the Readiness page (/readiness/roadmap) displays the OpenChain implementation roadmap. The roadmap provides a structured thirteen-phase schedule toward complete CRA readiness.
The PRIORITY row covers the Article 14 notification procedures. Before 11 September 2026 it shows that date as the deadline. From that date on it shows Applies now, because Article 14 reporting applies from 11 September 2026. All subsequent phases provide relative target windows anchored to your organization start date.
The PRIORITY row and the Overview tab can show different percentages. The Overview counts the item required for September 2026, the Vulnerability Handling Procedure. The PRIORITY row counts the register controls of its phase, such as the RACI, the Single Reporting Platform readiness and the awareness procedure.
Phase completion is calculated directly from your control register rows. When you update controls in your register, roadmap progress updates automatically.
Checklist items are adapted from the OpenChain CRA Compliance Checklist (Release Candidate 1, 19 August 2026), under CC BY 4.0. Completing checklist items does not constitute a formal conformity assessment or an EU Declaration of Conformity.