Short answer: every app in scope needs a written cybersecurity risk assessment, and it decides how the rest of the CRA applies to that app.

Article 13(2) requires manufacturers to assess the cybersecurity risks of each product and to use the result throughout planning, design, development, production, delivery and maintenance.

Article 13(3) sets the minimum content: intended purpose, reasonably foreseeable use and conditions of use, expected length of use, and how each Annex I requirement applies.

No method is prescribed. A threat model you can explain and defend is enough, as long as all relevant risks are covered and documented.

If an Annex I, Part I requirement does not apply to your app, you must say why (Article 13(4)). The vulnerability handling requirements of Part II always apply during the support period.

The assessment goes into the technical documentation, is updated during the support period and is kept for at least 10 years.…