Recital 12 of the Cyber Resilience Act draws a clear line: cloud services that support the functionality of a product with digital elements are remote data processing within scope. Cloud services that exist independently are not. If your product has any downloadable element — even a lightweight CLI or an npm package — the cloud infrastructure behind it becomes part of the regulated product. CRACheck generates the 8-document dossier under Article 31 + Annex VII in 15-25 minutes for €149. Designed for founders who cannot spend €15K on regulatory counsel before product-market fit.
€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side
You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.
If your product has a mobile app on the App Store or Google Play available to EU users, or distributes an npm/pip package, a CLI binary, a browser extension, or any code that executes on the user's device, that component is "placed on the market" per Article 3(21). The cloud backend then becomes remote data processing under Article 3(2), and the full product falls within CRA scope.
The CRA applies to products "made available on the market" (Article 2(1)), defined as any supply for distribution or use on the EU market in the course of a commercial activity (Article 3(22)). A free tier, a freemium model, or a beta with paying design partners constitutes commercial activity. Revenue is not the trigger — market availability is.
Article 13(1) requires that products be "designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I." This is a design-time obligation, not a post-launch audit. Retrofitting secure-by-default configuration, data minimization, and update mechanisms into an architecture built without them costs exponentially more than building them in from the start.
8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.
Maps your cloud-native product against Annex III categories. Identifies whether the client-side component or the remote data processing layer triggers a higher classification.
Article 31 + Annex VII dossier covering your full product: client-side component architecture, remote data processing backend, data flows, security controls, and third-party dependencies.
Cloud-specific cybersecurity risk analysis per Article 13(2)-(3): API attack surfaces, authentication weaknesses, supply chain risks from dependencies, data residency implications, and CI/CD pipeline integrity.
Annex II document adapted for a cloud product: how the client communicates with the backend, what data is processed remotely, how updates are delivered, and what security properties the user can expect.
Article 28 + Annex V formal declaration that your product meets CRA essential requirements. Covers both the client-side and remote processing components as a single product.
Coordinated vulnerability disclosure policy per Annex I, Part II. Includes security.txt reference, responsible disclosure timeline, and researcher communication protocol.
ENISA notification structure per Article 14 adapted for cloud-native incident scenarios: API breaches, dependency compromises, and container escapes.
Startup-relevant timeline: Art. 14 reporting from September 2026, full enforcement December 2027, support period per Article 13(8), and conformity reassessment triggers upon substantial product changes (Article 22).
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated from your data, in your browser. No data leaves your device.
Produces the 8 regulatory documents required before your product can be legally placed on the EU market. Covers technical documentation, risk assessment, declaration of conformity, user information, vulnerability handling policy, and incident notification templates. This is the documentation layer your EU prospect or investor asks about.
Does not run SAST/DAST scans on your code. Does not perform penetration testing on your APIs. Does not certify your container orchestration security. Does not monitor your third-party dependency updates. Does not serve as a notified body. Those are operational security tasks your engineering team handles.
CRACheck is the documentation. Your security practices are the substance. Both are necessary. CRACheck takes 15 minutes. The other is your ongoing engineering work.
Article 64 of Regulation (EU) 2024/2847.
Non-compliance with Annex I essential requirements or Art. 13/14 obligations.
Missing Art. 31 technical documentation or Art. 28 declaration.
Misleading information to authorities.
| Criteria | Regulatory consultant | Law firm | Y Combinator compliance template | CRACheck |
|---|---|---|---|---|
| Time | 6-12 weeks | 8-16 weeks | Self-guided (weeks) | 15-25 minutes |
| Cost | €8,000-€20,000 | €15,000-€30,000 | Free but generic | €149 |
| Understands cloud-native | Varies | Rarely | No | Architecture-agnostic input |
| Covers all 8 CRA documents | Partial | Partial | No | Yes |
Each independently marketed product needs its own Article 31 dossier. If your startup offers separate products — a main platform, an analytics add-on, a developer SDK — each requires documentation. Volume pricing: 10 products at €99, 30 at €79.
Request Volume PricingCRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 + Annex VII and that the legal references cited are correct. We do not guarantee acceptance by a specific market surveillance authority.
CRACheck is not legal advice. For questions about CRA scope, remote data processing classification, or conformity assessment requirements specific to your product, consult a qualified attorney.
Eight documents. Article 31 + Annex VII fully structured. Regulation (EU) 2024/2847. Your data stays on your device. The ZIP you download is yours forever.