Reg (EU) 2024/2847Generate dossier — €149
LIVE — Enforcement tracker · Deadline dashboard · Transposition status — Updated weekly from EUR-Lex, Safety Gate, OEIL & 12 official sourcesView regulatory intelligence →

Your product is listed in Annex III of Regulation (EU) 2024/2847 as Important Class I. This changes the conformity assessment route. If you have applied the relevant harmonised standard in full, Module A self-assessment is sufficient. If you have not — or if the standard does not exist yet — Article 32.2 requires conformity assessment by a notified body under Module B+C or Module H. CRACheck generates the technical documentation the notified body will review.

Annex III lists 19 categories of Important Class I products and 4 categories of Class II. If your product falls in Class I, you must determine whether harmonised standards under Regulation (EU) 2024/2847 have been published and whether you have applied them fully. If yes: Module A self-assessment. If no: notified body assessment. Either way, Article 31 and Annex VII require technical documentation. CRACheck generates 8 PDF documents covering all Annex VII sections. 15-25 minutes. €149. The documentation is the same regardless of which assessment route applies. Browser-side.

Generate CRA dossier — €149Free: check your product classification

€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side

Regulation (EU) 2024/2847 · Art. 31 + Annex VII · 8 documents · 100% browser-side

Key numbers

19 categories
Annex III Class I. From identity management to smart home, from routers to wearables.
Art. 32.2
Without harmonised standards: Module B+C or Module H assessment by notified body.
€149
Annex VII documentation is the same for Module A or notified body assessment.

How to determine your CRA conformity assessment route as a Class I manufacturer

The documentation obligation is the same for all Class I products. The assessment route depends on harmonised standard availability.

1
Confirm Annex III classification
Review the 19 Class I categories. Use CRACheck classifier to determine which category your product falls under.
2
Check harmonised standard availability
Have harmonised standards under Regulation (EU) 2024/2847 been published in the Official Journal for your product category? Check EUR-Lex.
3
If harmonised standard available and fully applied
Module A self-assessment under Art. 32.1(a). You assess conformity yourself. No notified body needed.
4
If no harmonised standard or not fully applied
Art. 32.2 requires Module B+C (EU-type examination + internal production control) or Module H (full quality assurance) by a notified body.
5
Generate Annex VII documentation
CRACheck generates the 8-document dossier. This documentation is the input for both Module A and notified body assessment routes.
6
If notified body route: submit documentation
The notified body reviews your Annex VII documentation. CRACheck generates it; the notified body evaluates it.

The documentation obligation is the same for all Class I products. The assessment route depends on harmonised standard availability.

Class I conformity assessment mistakes

❌
ART. 32.2

Class I always requires a notified body

Not always. Article 32.2 first subparagraph of Regulation (EU) 2024/2847 states that if the manufacturer has applied harmonised standards, common specifications or European cybersecurity certification schemes covering the essential cybersecurity requirements, Module A self-assessment is sufficient even for Class I. The notified body is required only when harmonised standards are not fully applied.

❌
ANNEX VIII

Module A is simpler than Module B+C — the documentation is different

The Annex VII technical documentation is the same regardless of the conformity assessment module. Module A means you assess it yourself. Module B+C means a notified body reviews the same documentation and issues a certificate. Module H means the notified body assesses your quality management system. The documentation obligation does not change.

❌
ANNEX III

My product is not exactly listed in Annex III — it is similar but not identical

Annex III categories describe product types, not specific model numbers. "Routers, modems intended for the connection to the internet, and switches" covers all consumer and enterprise routers. "Smart home products with security functionalities" covers any smart home device with security features. If your product fits the functional description, it is Class I. Use the CRACheck classifier for formal determination.

What each CRACheck dossier contains: 8 documents

Annex VII documentation is required for all Class I products, regardless of whether Module A or notified body assessment applies. CRACheck generates the 8-document package.

1

Product Classifier

Determines product category per Annex III. Defines conformity assessment route under Art. 32.

2

Technical Documentation

Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.

3

Risk Assessment

Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.

4

User Information

Information and instructions per Annex II. Security properties, support period, vulnerability reporting.

5

Declaration of Conformity

EU declaration of conformity per Art. 28 and Annex V.

6

CVD Policy

Coordinated Vulnerability Disclosure policy per Annex I Part II.

7

ENISA Notification Template

Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.

8

Obligations Calendar

Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated in your browser. No product data is transmitted to any server.

What you pay for Class I documentation

🧾 NOTIFIED BODY FULL-SERVICE (DOCS + ASSESSMENT)
€8,000–€25,000
Documentation + assessment. 3-6 months.
✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history