Note: Products covered by the AI Act and the CRA
Scope
This note is intended for manufacturers of products with digital elements that are, at the same time, high-risk AI systems (AI Act, Art. 6) and products covered by the Cyber Resilience Act (Regulation (EU) 2024/2847). Unlike the NIS2 ↔ DORA relationship - two organisational risk management regimes resolved by lex specialis -, here the relationship is one of presumption of conformity and single conformity assessment on the cybersecurity axis.
The two regulations apply cumulatively, but the legislator built an explicit bridge at the technical cybersecurity level to avoid duplicated work.
The Manual's response to each AI Act obligation (covered, declared gap or out of scope) is in “What this Manual covers and what stays out”.
The relationship is not lex specialis - it is a presumption of conformity
Art. 12 of the CRA — a rule that the AI Act now mirrors in Article 42(3), inserted by Regulation (EU) 2026/1744 — establishes that a product classified as a high-risk AI system under Art. 6 of the AI Act is deemed to comply with the cybersecurity requirements of Art. 15 of the AI Act when three conditions are met cumulatively:
| Condition (CRA Art. 12) | What it requires | Where SbD-ToE comes in |
|---|---|---|
| Annex I, Part I of the CRA | Essential cybersecurity requirements of the product | Ch. 04 (architecture), Ch. 10 (testing), Ch. 12 |
| Annex I, Part II of the CRA | Vulnerability handling requirements (the manufacturer's processes) | Ch. 05 (SBOM/SCA), Ch. 12 |
| EU declaration of conformity | Demonstrate in it the level of cybersecurity required by Article 15 of the AI Act | Aggregated technical evidence (Ch. 03–12); the declaration is the manufacturer's and is outside the Manual's scope |
Once all three are met, there is no need to demonstrate Article 15 of the AI Act separately: declared conformity with the CRA counts as conformity with that AI Act requirement.
Single conformity assessment
CRA Art. 12 refers the assessment to the conformity assessment procedure of Art. 43 of the AI Act. In addition, the notified bodies competent for the high-risk AI system under the AI Act are also competent to control the conformity with Annex I of the CRA (subject to Art. 39 of the CRA). Practical result: one assessment, one declaration (and a single notified body where the Art. 43 procedure provides for one; for the systems in Annex III, points 2 to 8, the procedure is the internal control of Annex VI, without a notified body — Article 43(2)) - covering the cybersecurity axis of both regulations.
⚖️ Derogation. Important products (CRA, Annex III) and critical products (Annex IV) that are high-risk AI systems subject to the internal control of Annex VI of the AI Act are subject, as regards the essential cybersecurity requirements, to the conformity assessment procedures of the CRA (Article 12(3)). Determining the procedure is a compliance/legal matter.
Where the scopes intersect and where they diverge
| Topic | AI Act | CRA | Convergence |
|---|---|---|---|
| Product cybersecurity | Art. 15 | Annex I, Parts I and II | Presumption (CRA Art. 12) |
| Vulnerability handling | Implicit in Art. 15 | Annex I, Part II (detailed) | Common technical basis — the presumption (CRA Art. 12) is the conformity mechanism, not the mere adoption of the process |
| Supply chain / SBOM | Art. 15 (integrity) | Annex I | Single SBOM (Ch. 05) |
| Reporting | Art. 73 (serious incidents) | Art. 14 (actively exploited vulnerabilities / severe incidents, to the coordinating CSIRT and ENISA: 24 h / 72 h / final report) | Separate channels, shared detection basis (Ch. 12) |
| CE marking / declaration | Art. 43, 47–49 | CRA assessment | Coordinated via Art. 12 (outside the Manual's scope) |
| Data governance, human oversight, transparency, FRIA | Art. 10, 13, 14, 27 | — | AI Act only (outside the CRA). In SbD-ToE: oversight covered (ARC-014, floor CTX-AIA-RE-P08); Art. 13 and Art. 27 with evidence; Art. 10 out of scope |
What remains specific to each regulation
AI Act only (not covered by the CRA presumption): risk management (Art. 9), data governance and bias (Art. 10), human oversight (Art. 14), transparency (Art. 13 and 50), fundamental rights impact assessment (Art. 27) and the GPAI obligations (Art. 53/55). The presumption of Art. 12 of the CRA covers only Art. 15 (cybersecurity) - all the other obligations applicable to high-risk AI systems under the AI Act remain in full.
CRA only: vulnerability handling across the whole lifecycle (Annex I, Part II), coordinated vulnerability disclosure, the obligation to provide security updates and the support period, and the reporting of actively exploited vulnerabilities to the CSIRT designated as coordinator and to ENISA (Art. 14).
Duplication Risks (Avoid)
| Potential duplication | Why avoid it | Recommended single form |
|---|---|---|
| Two cybersecurity conformity assessments | Cost and inconsistency | Invoke the presumption of CRA Art. 12; a single assessment (Art. 43 AI Act) |
| Two vulnerability handling processes | Divergence of SLAs/records | Implement the CRA one (Annex I, Part II); it also serves Art. 15 |
| Two SBOM inventories | Overhead, drift | Single SBOM/AI-BOM (Ch. 05) |
| Two technical evidence bases | Rework | Single cybersecurity evidence (Ch. 03, 04, 10, 12) tagged by source |
Single Implementation Strategy (SbD-ToE)
✏️ Refresh 2026-09-27. Strategy aligned with the AI Act coverage matrix: the EU declaration and the conformity assessment are outside the Manual's scope, which provides the technical evidence. It incorporates the agentic release (
ARC-015,DEP-012,OPS-012..014, Policy 38, Policy 39).
- Single cybersecurity evidence (Ch. 03 agentic playbook, Ch. 04
ARC-014/ARC-015, Ch. 10 §C5, Ch. 12 +OPS-011..014) — serves Article 15 of the AI Act and Annex I (Parts I and II) of the CRA at the same time. - Single vulnerability handling process (Ch. 05
DEP-011..014, Ch. 12, Policy 39 §7) in accordance with Annex I (Part II) of the CRA — it also serves as evidence for the cybersecurity strand of Art. 15 (the accuracy and robustness of Art. 15 fall outside the presumption of Article 12 of the CRA and must be demonstrated separately; in the Manual they are a declared gap, pending the AISVS/SAIF round of AppSec Core), including the response to upstream incidents in the AI supply chain (AML.T0019,AML.T0109,AML.T0110). - SBOM + single AI BOM (Ch. 05
DEP-012in CycloneDX 1.6 ml-bom format, Policy 39) feeding both regulations — it satisfies CRA Annex I Part II(1) (SBOM) and serves as evidence for AI Act Article 10(2), point (b) (origin of data) and for Article 11/Annex IV (description of third-party components and tools). - EU declaration of conformity (outside the Manual's scope; in the hands of the manufacturer and the legal team), supported by the single body of technical evidence from steps 1–3, which demonstrates the level of cybersecurity of Art. 15 and triggers the presumption of Art. 12 of the CRA. Contractual clauses with AI service vendors (Ch. 14 US-21 + Policy 33 §10) declare compliance with Art. 53/55 in the case of GPAI.
- Single conformity assessment (outside the Manual's scope) under the relevant procedure of Art. 43 of the AI Act (with a notified body where that procedure provides for one), extended to Annex I of the CRA (CRA, Article 12(2)).
- Regulatory origin — declare contexts CTX-AIA-RE and CTX-CRA on the application; the pages Applicable requirements of the AI Act and of the CRA show the requirements that each context elevates or adds, with the legal basis of each.
- ⚡ Cross-cutting agentic layer —
ARC-015(agent as principal),REQ-AGN-001..004(mandate, kill-switch, intent),OPS-012..014(audit per tool, budget, jailbreak detection) and Policy 38 (mandates lifecycle) provide technical controls relevant to Art. 14, Art. 15 and Art. 26 of the AI Act and to Annex I (Parts I and II) of the CRA (cybersec by design). These controls are technical evidence, not a declaration of conformity: the CRA (Art. 12) establishes a presumption of conformity only with Art. 15 of the AI Act (cybersecurity) when Annex I is complied with and demonstrated in the EU declaration of conformity. Art. 14 (human oversight) and Art. 26 (deployers) are not covered by that presumption — they remain obligations in their own right.
Convergence Checklist (YES = ready)
- Cybersecurity evidence mapped simultaneously to Art. 15 (AI Act) and to Annex I, Parts I and II (CRA) — including
ARC-015and eval suites (Ch. 10 §C5). - Vulnerability handling process in accordance with Annex I, Part II (CRA) documented, with an extension to the upstream AI supply chain (Policy 39 §7).
- EU declaration of conformity demonstrates the level of cybersecurity of Art. 15 (CRA Art. 12).
- Single conformity assessment (Art. 43 AI Act), agreed with the notified body where the applicable procedure provides for one.
- Single SBOM + AI BOM (CycloneDX 1.6
ml-bomfor the AI part) covers both regulations. - Separate reporting channels (AI Act Art. 73 / CRA Art. 14) with a shared technical detection basis (
OPS-014+ Policy 30 §9.3). - Contexts CTX-AIA-RE and CTX-CRA declared on the application, with the floor entries and the requirements added by each regime applied.
- Mandates (Policy 38) declare both the A0–A4 level (AI Act Art. 14) and cybersec measures (CRA Annex I Part I).
- There are no divergent parallel cybersecurity processes.
Frequently Asked Questions
Q1. Do I need to carry out two cybersecurity conformity assessments? No. CRA Art. 12, read in conjunction with Art. 43 of the AI Act, allows a single assessment - where the Art. 43 procedure involves a notified body, that body can control both (CRA, Article 12(2)); under the internal control of Annex VI (Article 43(2)) no notified body is involved.
Q2. Does the CRA replace Art. 15 of the AI Act? It does not. It creates a presumption of conformity with Art. 15 when the manufacturer meets Annex I (Parts I and II) and demonstrates it in the declaration. The other obligations that apply to high-risk AI systems under the AI Act remain.
Q3. And vulnerability handling? The CRA's process (Annex I, Part II) should be implemented — it is the more detailed one and serves as the common basis. It does not, on its own, satisfy Art. 15: the presumption of Article 12 of the CRA also requires Part I and demonstration in the EU declaration, and it covers only cybersecurity (not accuracy or robustness).
Q4. Are the reports the same? No. The AI Act (Art. 73, serious incidents) and the CRA (Art. 14, actively exploited vulnerabilities/severe incidents, to the coordinating CSIRT and ENISA) have distinct triggers, time limits and channels. They share the technical detection (Ch. 12); submission is parameterised per regulation.
References
- Regulation (EU) 2024/1689 (AI Act) - Art. 6, 15, 42 (paragraph 3, inserted by Regulation (EU) 2026/1744), 43.
- Regulation (EU) 2024/2847 (CRA) - Art. 12, Art. 14, Annex I (Parts I and II), Annexes III/IV.
- Cross-check AI Act and Cross-check CRA (in this chapter).
- SbD-ToE Manual (Ch. 01–Ch. 14).
Final Note
SbD-ToE already abstracts the technical cybersecurity controls. AI Act/CRA convergence materialises by using the same technical evidence for both and by invoking the presumption of Article 12 of the CRA: one assessment, one declaration, two regulations satisfied on the cybersecurity axis - without redundancy, while keeping the obligations specific to each regime.