The energy sector faces the CRA's most demanding classification. Annex IV item 2 explicitly lists "smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 and other devices for advanced security purposes, including for secure cryptoprocessing." This is a Critical product — above Important Class I and II. Art. 32(4) limits conformity assessment to a European cybersecurity certification scheme under Art. 8(1) or, where that scheme is not yet available, EU-type examination (Module B+C) or full quality assurance (Module H). Beyond the CRA, NIS2 classifies energy operators as essential entities, and Directive (EU) 2019/944 mandates smart meter deployment across the EU. Your product sits at the intersection of all three. CRACheck generates the 8-document Art. 31 technical file. €149 per product. 15-25 minutes. Grid architecture data stays in your browser.
€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side
Annex IV item 2 of Regulation (EU) 2024/2847 explicitly classifies smart meter gateways as Critical. This is the highest CRA classification. Internal control (Module A) is not available. Attempting to classify your gateway as Default to avoid notified body involvement or certification scheme requirements is non-compliant from the classification step.
Art. 32(4)(b) of Regulation (EU) 2024/2847 allows EU-type examination (Module B+C) or full quality assurance (Module H) when no European cybersecurity certification scheme under Art. 8(1) is available. These involve notified body assessment. Internal control (Module A) is never available for Critical products regardless of harmonised standard availability.
Art. 13(8) of Regulation (EU) 2024/2847 requires the support period to reflect expected use time. Smart meter gateways are deployed in utility infrastructure for 15-20 years. A 5-year support period leaves a decade of unsupported, connected, critical infrastructure — precisely the scenario the CRA was designed to prevent.
8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.
Identifies Critical classification for smart meter gateways (Annex IV item 2). Other grid products classified as Important Class I or Default based on functionality.
Art. 31 and Annex VII documentation for energy sector equipment: system architecture, cryptographic specifications, secure boot, key management, grid integration protocols.
Cybersecurity risk assessment covering energy-sector vectors: grid manipulation, mass meter compromise, consumption data integrity, cryptographic key extraction, firmware supply chain.
Annex II information for utility deployment: secure installation in metering infrastructure, key provisioning, firmware update procedures, vulnerability reporting, support period aligned with grid lifecycle.
EU Declaration per Art. 28 and Annex V for Critical product.
Coordinated vulnerability disclosure policy aligned with energy-sector CERT practices and ICS-CERT coordination.
ENISA notification template per Art. 14 with critical infrastructure urgency context.
Key dates: Art. 14 from September 2026, full enforcement December 2027, Commission certification scheme adoption milestones, utility deployment windows.
See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.
Generated from your data, in your browser. No data leaves your device.
CRACheck generates the Art. 31 and Annex VII technical documentation for your energy sector product. For Critical products like smart meter gateways, this documentation is the foundation for the conformity assessment dossier that a notified body or certification scheme will review. Eight documents covering classification, risk assessment, system architecture, vulnerability handling, SBOM, declaration of conformity, ENISA template and obligations calendar.
CRACheck does not perform the notified body assessment required for Critical products under Art. 32(4). It does not conduct penetration testing on smart meter gateways. It does not manage cryptographic key infrastructure. It does not submit ENISA notifications. It does not produce NIS2 documentation for your utility clients. For Critical products, CRACheck generates the documentation — the conformity assessment itself requires external expertise.
Critical classification demands the most rigorous conformity assessment. CRACheck provides the documentary foundation. The assessment itself requires external expertise.
A vulnerability in smart meter gateways triggers 24h ENISA notification. Grid-level systemic impact makes this the highest-urgency reporting category in the CRA.
Smart meter gateways must carry CE marking based on Critical product conformity assessment and Art. 31 documentation. Utility procurement will not accept products without both.
For Critical product manufacturers non-compliant with Art. 13 or Annex I. The penalty tier is the same for Critical and Default, but enforcement scrutiny on Critical products is proportionately higher.
| Criterio | Energy cybersecurity consultancy | Internal compliance team | Ignore until certification scheme | CRACheck |
|---|---|---|---|---|
| Price | €25K-60K | Staff time | Deferred risk | €149 per product |
| Art. 31 documentation | Report | Variable quality | None | 8-document file |
| Certification scheme foundation | Possibly | Depends | None | Yes — structured for dossier |
| Data privacy | Shared with consultant | Internal | N/A | 100% browser-side |
| CRACheck | €149 | 8-doc | Dossier-ready | Browser-side |
Pack 10: €99 per product. Pack 30: €79 per product. For energy sector manufacturers with multi-generation product portfolios, contact us for enterprise pricing.
Request volume pricingCRACheck generates a structured document set according to Art. 31 and Annex VII of Regulation (EU) 2024/2847 based on the information you provide. The accuracy of cryptographic specifications, grid architecture data and component inventories is your responsibility as manufacturer.
We guarantee that the document structure follows Art. 31 and Annex VII and that the legal references cited are correct. We do not guarantee acceptance by a notified body, certification scheme, market surveillance authority or utility procurement process.
CRACheck is not legal advice. For Critical product conformity assessment, certification scheme selection and the interaction between CRA, NIS2 and Directive (EU) 2019/944, consult a qualified energy sector regulatory lawyer.
Smart meter gateways are Annex IV Critical products. Art. 32(4) demands notified body or certification scheme assessment. CRACheck generates the Art. 31 documentation that feeds into that assessment. Eight documents. €149. Browser-side.