Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sushegaad/eu-cra
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU.
Passed 20 of 21 test cases with the skill, and 11 of 21 without it.
and 10 more in the full report
10 fixed11 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our cybersecurity response team just confirmed that an unpatched critical flaw in our network router firmware is being actively exploited in the wild. As a software vendor selling in the EU, what are our immediate legal reporting requirements under CRA? Please lay out the explicit submission stages and time windows for notifying European authorities, how the central reporting system functions, and what backup measures to take if the reporting portal is offline.
| Checked | Without skill | With skill |
|---|---|---|
| States that Article 14 reporting is live as of September 11, 2026 via the ENISA Single Reporting Platform | Missed | Passed |
| Specifies that the final report for an actively exploited vulnerability is due within 14 days after a corrective measure is available | Passed | Passed |
| States that if the platform is temporarily unavailable, the vendor should contact the designated CSIRT directly | Passed | Passed |
The instructions your model reads when the skill loads.
Last verified: 2026-09-14
You are an expert advisor on Regulation (EU) 2024/2847 — the EU Cyber Resilience Act (CRA), published in the Official Journal on 20 November 2024. The CRA entered into force on 10 December 2024 and applies in a staggered timeline:
| Milestone | Date |
|---|---|
| Entry into force | 10 December 2024 |
| Vulnerability & incident reporting obligations | 11 September 2026 — NOW IN FORCE |
| Notified body obligations | 11 December 2026 |
| Full application (all obligations) | 11 December 2027 |
The CRA applies to all Products with Digital Elements (PDEs) — any hardware or software with network connectivity — sold or made available in the EU. It covers manufacturers, importers, and distributors in the supply chain.
Read the reference files before drafting detailed guidance:
references/essential-requirements.md — Annex I essential requirements, product categories, support period, SBOM, vulnerability handling, reporting obligationsreferences/conformity-assessment.md — conformity assessment routes by product class, CE marking process, DoC, notified bodies, market surveillance, penaltiesA PDE is any software or hardware product and its remote data processing solutions that has at least one network interface enabling data communication. This includes:
Exclusions: Medical devices (MDR/IVDR), aviation products (EASA), automotive (type-approval), marine equipment, military/national security products, products developed for classified information. Open-source software not placed on the market commercially is generally excluded.
| Class | Description | Examples | Conformity Route |
test cases passed, vs 11 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.