CRA dossier: contents and how to use it
Product: COOK version 2.0.0
Manufacturer: Bilal El Homsi
Generated: 2026-10-24 by cra-dossier 0.1.0 from the repository cook at commit cd17b114fbab
Regulation: Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj
DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.
What this is
A draft set of the documents a manufacturer of a product with digital elements holds under Regulation (EU) 2024/2847 when it self-assesses (internal control, Article 32(1)(a) and Annex VIII, Part I). It was drafted from the repository by cra-dossier; nothing in it was reviewed by a lawyer or a notified body.
| File | What it is | Source in the regulation |
|---|---|---|
| 01_scope_and_classification.md | Is the product in scope, which class, which route, which dates | Articles 2, 3, 7, 8, 32, 69, 71; Annexes III and IV; Implementing Regulation (EU) 2025/2392 |
| 02_technical_file.md | The technical documentation, structured exactly as Annex VII | Article 31, Annex VII |
| 03_risk_assessment.md | The cybersecurity risk assessment skeleton with every Annex I Part I item | Article 13(2) to (4), Annex I Part I |
| 04_vulnerability_handling.md | Vulnerability handling processes, CVD policy draft, Article 14 reporting playbook | Annex I Part II, Article 13(6) to (9), Article 14 |
| 05_user_information.md | The information and instructions that accompany the product | Annex II, Article 13(16) to (20) |
| 06_support_period.md | The support period decision and its factors | Article 13(8), 13(9), 13(19) |
| 07_declaration_of_conformity_DRAFT.md | The EU declaration of conformity, unsigned, with the simplified form | Article 28, Annexes V and VI, Article 30 |
| 08_gap_list.md | Every requirement with a status, evidence and the action left | Annexes I, II, VII; Articles 13 and 14 |
| sbom.cdx.json and sbom_summary.md | The software bill of materials (CycloneDX) and its summary | Annex I Part II point (1), Annex VII point 8 |
| sbom_vulnerabilities.md | Known vulnerabilities in SBOM components (OSV) | Annex I Part I point (2)(a), Part II point (2) |
| SECURITY.md and security.txt | Coordinated vulnerability disclosure policy draft and the RFC 9116 contact file | Annex I Part II points (5) and (6), Article 13(17) |
| dossier.json | Machine-readable facts, statuses and hashes for the per-release refresh | Article 13(14), Article 31(2) |
Where it stands
63 items tracked: 5 with evidence, 29 partly shown, 14 not found, 14 manufacturer decisions, 1 declared not applicable. 57 items are open. The declaration must not be signed while items are open.
What stays human
- The cybersecurity risk assessment judgments (Article 13(2) and (3)).
- The support period and its end date (Article 13(8) and 13(19)).
- Any "not applicable" with its justification (Article 13(4)).
- The conformity assessment itself and the signature on the declaration (Article 13(12), Article 28(4): the manufacturer assumes responsibility).
- Whether the product is important or critical (Article 7, Article 8) and any notified-body involvement.
Re-issue per release
Run cra-dossier refresh <repo> on every release. It regenerates the SBOM, re-checks vulnerabilities, compares versions and flags a declaration that no longer matches the shipped version (Article 31(2): the technical documentation is continuously updated during the support period; Article 28(2): the declaration is updated as appropriate). The Commission guidance C(2026) 5252, section 4.3, explains when a software update is a substantial modification (new risks not covered by the risk assessment) and when it is not (security updates).