Free resource
CRA Annex I Checklist for Instrument Software
All 21 essential requirements of the EU Cyber Resilience Act, turned into practical checks for lab instruments and the software that runs them.
- 21 Annex I requirements covered
- Free PDF download
- Written for lab instrument makers
About this resource
What the CRA actually asks of your instrument software
From 11 December 2027, any product with digital elements placed on the EU market has to meet the essential cybersecurity requirements in Annex I of the Cyber Resilience Act. That covers the instrument, its firmware, and the control and analysis software that ships with it. Reporting duties for actively exploited vulnerabilities have applied since 11 September 2026.
Annex I has two parts. Part I sets 13 security properties the product must have. Part II sets 8 vulnerability handling processes the manufacturer must run for as long as the product is supported. Generic CRA checklists are written for routers and smart devices. This one is written for the realities of lab equipment: instrument PCs that sit offline, validated GMP environments where an automatic update can break the validated state, decades-old analysis code, vendor camera SDKs and licensing components nobody has inventoried.
Use it to see where each of your products stands, give every gap an owner, and decide which products need work first.
What's included
Inside the checklist
- Every Annex I requirement in plain language, with the article reference
- Practical checks for instrument software under each requirement
- The evidence you should be able to show for each one
- A Met / Partly / Not met / Not applicable score per requirement, with space to justify "not applicable" (the CRA expects that reasoning to be documented)
- The other CRA duties already running: 24 and 72 hour reporting, support period, SBOM, technical documentation
- A gap tracker with owner and target date columns
- Printable A4 format for review meetings
Requirements covered
The 21 essential requirements, in two parts
Part I: Product security properties
13 requirements
No known exploitable vulnerabilities at release. Secure by default, with a reset to original state. Security updates, including automatic updates users can opt out of or postpone. Access control and authentication. Confidentiality and integrity of data, commands and configuration. Data minimization. Availability of essential functions, including resilience to denial of service. Limited impact on other devices and networks. A limited attack surface. Exploit mitigation. Security logging. Secure, permanent data removal.
Part II: Vulnerability handling
8 requirements
An SBOM covering at least top-level dependencies. Fixing vulnerabilities without delay, with security updates separate from feature updates where feasible. Regular security testing and review. Public disclosure of fixed vulnerabilities. A coordinated vulnerability disclosure policy. A published contact for vulnerability reports. Secure update distribution. Free security updates with clear advisory messages.
Who this is for
Built for the people who have to sign it off
- Instrument and equipment manufacturers
- Product and engineering managers
- Software and firmware teams
- Regulatory and quality teams
- Pharma and biotech teams with in-house instrument software
- Distributors and importers selling into the EU
Whether you are scoping a single analyzer or an entire portfolio, the checklist gives you a structured first pass before you commit budget to remediation.
Related resources
Go further on the CRA
FAQ
Common questions
Is the checklist enough to prove CRA compliance?
No. It is a structured self-review that shows where your gaps are. Compliance is shown through your cybersecurity risk assessment, technical documentation, the conformity assessment for your product's class, and the EU declaration of conformity.
Does Annex I apply to software that only runs on an offline instrument PC?
Usually yes. The CRA covers products with digital elements that have a direct or indirect logical or physical data connection to a device or network. Instrument control and analysis software that talks to the instrument over USB, Ethernet or a serial link normally falls within scope, even if the PC never touches the internet. Check your own product's position, and take advice if it sits near a boundary such as the medical device or IVD regulations.
Do all 21 requirements apply to every product?
The 8 vulnerability handling requirements in Part II apply to every manufacturer. The 13 product requirements in Part I apply where relevant, based on your cybersecurity risk assessment. If you decide one does not apply, the CRA expects you to document why.
What are the key CRA deadlines?
Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026. The full essential requirements, conformity assessment and CE marking apply from 11 December 2027.
We already meet 21 CFR Part 11 and EU Annex 11. Does that help?
It helps. Access control, audit trails, data integrity controls and validated change management all overlap with parts of Annex I. Part 11 and Annex 11 do not cover vulnerability handling, SBOMs or security updates, so expect gaps there.
Found gaps you can't close in-house?
Our development teams have been building life science software since 1989, including analysis software for instruments under our own brand and for OEM partners. We remediate legacy instrument software or rebuild it around your existing hardware, and we produce the documentation the CRA expects.
Book a free CRA readiness audit