How to use the CRA Frameworks in Modulos

Modulos gives the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, as two Frameworks with the name Cyber Resilience Act:

• OFF-26 at the Organization level, on your organization AI System.
• MFF-26 at the AI System level, on one AI System for each AI-enabled product.

The sections below give the decisions to make before you add the CRA Frameworks, and the steps Modulos recommends. They also give the Requirements with their provisions, and the work with no Requirement in the two Frameworks. In these instructions, "you" is the organization that uses Modulos. First, identify which CRA obligations your organization has and which of its products are in scope. For the law, see Cyber Resilience Act (CRA).

The two CRA Frameworks

In Modulos, the CRA has two Frameworks at two levels. These levels are the structure of Modulos, not of the CRA.

AI System	Framework	Contents
The organization AI System	OFF-26 (Organization level)	The obligations of manufacturers, authorized representatives, importers, distributors, and open-source software stewards. Examples are the procedures for all products, the Article 14 reports, information for authorities, and the records.
One AI System for each AI-enabled product	MFF-26 (AI System level)	The Requirements for one product, from scope and the cybersecurity risk assessment to Annex I. Also vulnerability handling, the support period, information to users, technical documentation, and conformity assessment.

• Each AI System gets all Requirements of its Framework. The two Frameworks do not select Requirements for an AI System. For the Requirements that apply only to some persons, see Decisions before you add the Frameworks.
• Other Frameworks can be on the same AI Systems. For the Controls that are in the CRA Frameworks and also in other Frameworks, see Control overlap.

Organization AI Systems

Frameworks at the Organization level, for example OFF-26, attach to your organization AI System. This AI System has the Type Organization in the AI Registry. You cannot make a new organization AI System in the AI Registry. If your organization does not have one, contact Modulos Support before you add Frameworks at the Organization level.

Decisions before you add the Frameworks

Before you add the CRA Frameworks, make these four decisions. The CRA sets no sequence for them, and Modulos recommends this sequence. The CRA gives obligations to manufacturers, to other economic operators, and to open-source software stewards (Articles 13, 14, and 18 to 24). It does not tell you to record these decisions. In Modulos, you record decision 1 in ORF-468, decision 2 in MRF-450, and decisions 3 and 4 in MRF-451.

1. For each product, identify the obligations of each natural or legal person in your organization.
   • Use the definitions of economic operators and open-source software stewards in Article 3(13) to (17).
   • Check if a person is considered to be a manufacturer in Articles 21 and 22.
2. Identify the products in CRA scope.
   • Use the scope and products that the CRA does not include in Article 2.
   • Select the AI-enabled products in scope for MFF-26.
3. For each product, identify the product category.
   • Use Product categories and conformity assessment for Articles 7, 8, and 32.
   • Check if Article 12 applies to the product as a high-risk AI system.
4. For each product, identify the date of placing on the market and each substantial modification.
   • Article 69 gives transitional provisions for products placed on the market before 11 December 2027. Article 14 also applies to those products (Article 69(3)).

In Modulos, some Requirements of OFF-26 are only for some persons:

• ORF-469 to ORF-476 are for a manufacturer and for a person considered to be a manufacturer. ORF-475 and ORF-476 are also for an open-source software steward, in the conditions of Article 24(3).
• For the persons to which ORF-479 to ORF-482 apply, see Requirements of the CRA Frameworks. Each of these Requirements applies only if the Organization is that economic operator or steward.
• If the Organization is not the economic operator or steward of one of these Requirements, record that decision in ORF-468. In Modulos, this record completes that Requirement.

In MFF-26, MRF-469, MRF-473, and MRF-474 also apply to authorized representatives, and MRF-472 also applies to importers. If your Organization is an authorized representative or importer, check these Requirements for your products.

Modulos wants to use the CRA Role and CRA Product Category tags to put Requirements out of scope.

Steps that Modulos recommends

To use the CRA Frameworks, Modulos recommends the nine steps below, in this sequence. The CRA sets no sequence. Each step gives the Requirements and the section for the law.

1. Add the Frameworks and record the decisions (ORF-468, MRF-450).
   • Add OFF-26 to your organization AI System.
   • If a product selected in decision 2 has no AI System, make one in the AI Registry.
   • Add MFF-26 to the AI System of each product that you selected in decision 2.
   • Record decision 1 in ORF-468. Record decision 2 in MRF-450 of each AI System.
2. Send the Article 14 notifications and reports (ORF-476, and ORF-475 for Article 14(8)).
   • Since 11 September 2026, Article 14 applies to manufacturers. ENISA started the single reporting platform on that date.
   • For open-source software stewards and persons considered to be a manufacturer, see When the CRA applies.
   • Make a procedure that records when you become aware of an actively exploited vulnerability.
   • Also record when you become aware of a "severe incident having an impact on the security of the product with digital elements".
   • Prepare the notifications and reports of Article 14(2) and (4), with their time limits.
   • Get access to the single reporting platform (Article 16).
   • Identify the CSIRT designated as coordinator for your notifications (Article 14(7)).
   • Prepare the information to users of Article 14(8).
   • See Article 14 and Information to users.
3. For each product, identify the conformity assessment procedure (MRF-451).
   • Use the category from decision 3 to identify the procedures that Article 32 gives for it.
   • Then, for a high-risk AI system, examine Article 12(2) and the conditions of Article 12(3).
   • Record decisions 3 and 4 and the procedure in MRF-451.
   • See Article 12.
4. Make the procedures of the Organization (ORF-469 to ORF-475).
   • ORF-469 to ORF-474 are for these procedures for all products. ORF-475 is for Annex I, Part II, points (4) and (8).
   • The procedures are for the cybersecurity risk assessment, the support period, components, the software bill of materials (SBOM), and security updates. They are also for tests, coordinated vulnerability disclosure, and fixed vulnerabilities.
   • The obligations of Article 13 and Annex I apply from 11 December 2027 (Article 71(2)).
   • See Vulnerability handling and the support period.
5. For each product, do the cybersecurity risk assessment and the work of Annex I, Part I (MRF-452 to MRF-466).
   • Do the cybersecurity risk assessment of Article 13(2) and (3) (MRF-452).
   • Do the work of Annex I, Part I, point (1) (MRF-453). Point (1) has no "where applicable" condition.
   • Do the work of point (2), requirements (a) to (m) (MRF-454 to MRF-466).
   • Point (2) applies "On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable".
   • If a requirement of point (2) does not apply, put a "clear justification" in the technical documentation (Article 13(4)).
   • See Risk assessment and Annex I.
6. For each product, do the work of the product life cycle (MRF-467 to MRF-472).
   • MRF-467 is for components and remote data processing. See Components.
   • MRF-468 to MRF-472 are for the support period, the SBOM, tests, and vulnerability handling. They are also for security updates, product identification, and information to users.
   • See Vulnerability handling and the support period.
7. For each product, do the conformity assessment (MRF-473 to MRF-475).
   • Prepare the technical documentation.
   • Do the selected conformity assessment procedure.
   • After the conformity assessment shows conformity with Annex I, Parts I and II, prepare the EU declaration of conformity.
   • After the conformity assessment shows that conformity, affix the CE marking (Article 13(12)).
   • Make procedures that keep the products of a series of production in conformity (Article 13(14)).
   • See Technical documentation and EU declaration of conformity and CE marking.
8. Prepare for corrective measures and for work with authorities (ORF-477, ORF-478).
   • ORF-477 is for corrective measures and for the work with market surveillance authorities.
   • ORF-478 is for the records and the identification of economic operators.
   • See Information to authorities and records.
9. Do the work for the other economic operators and for stewards (ORF-479 to ORF-482).
   • If your organization is an authorized representative, an importer, a distributor, or a steward, do the work of that Requirement.
   • If it is not, record that decision in ORF-468.
   • See Economic operators and open-source software stewards.

Reviews in Modulos

For the Review of CRA Requirements MRF-454 to MRF-466, Modulos has this rule. If a requirement of Annex I, Part I, point (2) does not apply to the product, a "clear justification" for that product completes the Requirement. This is a rule of Modulos, not of the CRA. It is not for point (1) or for Annex I, Part II. For the Review procedure, see Reviews & Statuses.

Requirements of the CRA Frameworks

OFF-26 and MFF-26 give Requirements for the provisions below. Each Requirement has its name in Modulos, its level, its provisions in the CRA, and the section for the law.

Requirement	Level	Provisions	Section for the law
ORF-468 ‘CRA actor role and applicability governance’	Organization	Articles 2, 3(1), 3(2), 3(12) to (17), 3(20) to (22), 3(30), and 18 to 24	Economic operators
ORF-469 ‘Secure-product risk and compliance governance’	Organization	Article 13(1) to (7) and (14), Annex VIII, Part IV, points 2 to 4	Risk assessment
ORF-470 ‘Portfolio support-period governance’	Organization	Articles 13(8), 13(11), 13(19), and 52(16)	Support period
ORF-471 ‘Component and SBOM governance’	Organization	Article 13(5) to (7), (22), (24), and (25), Annex I, Part II, points (1) and (6), Annex VII, points 2(b) and 8	SBOM
ORF-472 ‘Security-update operations’	Organization	Article 13(8) to (10), Annex I, Part II, points (2), (7), and (8)	Security updates
ORF-473 ‘Product security testing program’	Organization	Annex I, Part II, point (3), Annex VII, point 6	Tests
ORF-474 ‘Vulnerability disclosure and intake’	Organization	Article 13(8) and (17), Annex I, Part II, points (5) and (6), Annex II, point 2	Coordinated vulnerability disclosure
ORF-475 ‘Security advisory and user communication’	Organization	Articles 13(18), 14(8), 17(2), and 24(3), Annex I, Part II, points (4) and (8)	Information to users
ORF-476 ‘Mandatory vulnerability and incident reporting’	Organization	Articles 14, 16, 24(3), 69(3), and 71(2), Delegated Regulation (EU) 2026/881	Article 14
ORF-477 ‘Post-market corrective action and authority cooperation’	Organization	Articles 13(21) to (23), 53, 54(1), 54(4), 56(3), 57(2), 57(7), and 58	Authorities
ORF-478 ‘Compliance records and economic-operator traceability’	Organization	Articles 13(13), 13(18), 18(3)(a), 19(6), 23, and 31(2)	Records
ORF-479 ‘Authorised representative mandate and duties’	Organization	Articles 18 and 30(4), Annex VIII	Authorized representatives
ORF-480 ‘Importer placing-on-the-market and subsequent duties’	Organization	Articles 19, 21, and 23	Importers
ORF-481 ‘Distributor due-care and making-available duties’	Organization	Articles 20, 21, and 23	Distributors
ORF-482 ‘Open-source software steward cybersecurity duties’	Organization	Articles 3(14), 15(1), 15(2), 24, and 52(3)	Open-source software stewards
MRF-450 ‘CRA applicability and product boundary’	AI System	Articles 2, 3(1), 3(2), 3(13), 3(21), 3(22), 3(48), 4(2) to (4), 6, 21, 22(1), and 69(2)	Scope
MRF-451 ‘Product category, modification, and conformity route’	AI System	Articles 3(30), 7, 8, 12, 21, 22, and 32, Implementing Regulation (EU) 2025/2392	Product categories
MRF-452 ‘Cybersecurity risk assessment’	AI System	Article 13(2) to (4) and (7), Annex VII, point 3	Risk assessment
MRF-453 ‘Risk-based cybersecurity outcome’	AI System	Articles 6(a) and 13(1) to (3), Annex I, Part I, point (1)	Point (1)
MRF-454 ‘No known exploitable vulnerabilities’	AI System	Annex I, Part I, point (2)(a)	Point (2)
MRF-455 ‘Secure defaults and reset’	AI System	Annex I, Part I, point (2)(b)	Point (2)
MRF-456 ‘Secure and usable updates’	AI System	Annex I, Part I, point (2)(c)	Point (2)
MRF-457 ‘Access control and access reporting’	AI System	Annex I, Part I, point (2)(d)	Point (2)
MRF-458 ‘Data confidentiality protection’	AI System	Annex I, Part I, point (2)(e)	Point (2)
MRF-459 ‘Data and software integrity’	AI System	Annex I, Part I, point (2)(f)	Point (2)
MRF-460 ‘Product data minimization’	AI System	Annex I, Part I, point (2)(g)	Point (2)
MRF-461 ‘Essential-function availability and resilience’	AI System	Annex I, Part I, point (2)(h)	Point (2)
MRF-462 ‘Connected-service availability protection’	AI System	Annex I, Part I, point (2)(i)	Point (2)
MRF-463 ‘Attack-surface limitation’	AI System	Annex I, Part I, point (2)(j)	Point (2)
MRF-464 ‘Exploitation-impact mitigation’	AI System	Annex I, Part I, point (2)(k)	Point (2)
MRF-465 ‘Security activity logging and user control’	AI System	Annex I, Part I, point (2)(l)	Point (2)
MRF-466 ‘Secure data removal and transfer’	AI System	Annex I, Part I, point (2)(m)	Point (2)
MRF-467 ‘Component and remote-solution assurance’	AI System	Articles 3(1), 3(2), and 13(5) to (7), Annex I, Part II, point (6)	Components
MRF-468 ‘Support-period determination and disclosure’	AI System	Articles 3(20), 13(8), 13(11), and 13(19), Annex II, point 7, Annex VII, point 4	Support period
MRF-469 ‘SBOM and vulnerability record’	AI System	Articles 13(22), 13(25), and 32(5), Annex I, Part II, point (1), Annex II, point 9, Annex VII, points 2(b) and 8	SBOM
MRF-470 ‘Product security testing and review’	AI System	Annex I, Part II, point (3), Annex VII, point 6	Tests
MRF-471 ‘Remediation, update delivery, and advisories’	AI System	Article 13(8) to (10), Annex I, Part II, points (2), (4), (7), and (8)	Security updates
MRF-472 ‘Product identity, information, and instructions’	AI System	Articles 13(15) to (20) and 19(4), Annex II	Information to users
MRF-473 ‘Technical documentation and lifecycle maintenance’	AI System	Articles 13(4), 13(12), 13(13), 31, 32(5), and 33(5), Annex VII	Technical documentation
MRF-474 ‘Conformity, declaration, and CE marking’	AI System	Articles 13(12), 13(20), 28, 29, 30, and 32, Annexes V, VI, and VIII	EU declaration of conformity
MRF-475 ‘Continuous conformity and corrective action’	AI System	Article 13(14) and (21)	Series of production

The CRA Frameworks have no Requirement for Article 25, Article 33(1) to (4), Chapter IV (Articles 35 to 51), or Article 64. See Work with no Requirement in the CRA Frameworks.

Work with no Requirement in the CRA Frameworks

For these items, the CRA Frameworks OFF-26 and MFF-26 have no Requirement. The items below identify the persons and authorities that do this work.

• Penalties. Each Member State makes the rules on penalties for infringements of the CRA (Article 64). See Market surveillance and penalties.
• Notified bodies. Chapter IV (Articles 35 to 51) gives the notification of conformity assessment bodies. If the conformity assessment procedure of a product includes a notified body, work with a notified body. See Product categories and conformity assessment.
• Tasks of the authorities. The CSIRTs designated as coordinators, ENISA, and the market surveillance authorities have different tasks. Examples are in Articles 16, 17, and 54 to 60, and in Delegated Regulation (EU) 2026/881. The Requirements apply only to the obligations of your organization.
• Article 33(1) to (4). These paragraphs give tasks to the Member States and the Commission. Paragraphs 1, 2, and 4 name microenterprises and small enterprises. Paragraph 3 gives Commission guidance for "microenterprises and small and medium-sized enterprises".
• Article 25. In Article 25, the Commission "is empowered to adopt delegated acts" for free and open-source software, "establishing voluntary security attestation programmes".

For Article 13(24), Article 33(5), standards, and guidance, see CRA guidance and acts.

As of October 2026, COM(2025) 837 (Digital Omnibus) is not law. See CRA guidance and acts.

Where to go next

Cyber Resilience Act overview

When each part of the CRA applies, the structure, the guidance, and the penalties

Scope, product categories, and conformity

Article 2, the categories of Articles 7 and 8, Article 12, and the conformity assessment procedures

Reporting obligations and economic operators

The notifications of Article 14 and the obligations of Articles 18 to 24

Reviews & Statuses

The Review of a Requirement in Modulos

Sources

• Cyber Resilience Act, Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 "on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)", OJ L, 2024/2847, 20.11.2024 (EUR-Lex).
  • Articles 2 to 4, 6 to 8, 12 to 25, 28 to 33, 35 to 60, 64, 69, and 71.
  • Annex I to Annex VIII.
• Implementing Regulation (EU) 2025/2392 of the Commission of 28 November 2025 "on the technical description of the categories of important and critical products with digital elements pursuant to Regulation (EU) 2024/2847 of the European Parliament and of the Council", OJ L, 2025/2392, 1.12.2025 (EUR-Lex).
• Delegated Regulation (EU) 2026/881 of the Commission of 11 December 2025 "supplementing Regulation (EU) 2024/2847 of the European Parliament and of the Council by specifying the terms and conditions for applying the cybersecurity-related grounds in relation to delaying the dissemination of notifications", OJ L, 2026/881, 20.4.2026 (EUR-Lex).
• AI Act, Regulation (EU) 2024/1689: Article 6 (EUR-Lex).
• ENISA, news of 11 September 2026 about the start of the single reporting platform (ENISA).

Disclaimer

This page gives general information. It is not legal advice. Modulos recommends this sequence. Some steps include work with no CRA obligation.

Before you make a decision, read Regulation (EU) 2024/2847. For decisions about your organization, get information from a person who knows the law.