Indian SaaS startups targeting EU enterprise clients face a new gate in the procurement process. Regulation (EU) 2024/2847 applies to products with digital elements made available on the EU market. Article 3(1) defines the manufacturer as the entity that markets the product under its name or trademark. If that is your startup, you hold the manufacturer obligations under Article 13 — cybersecurity risk assessment, technical documentation, vulnerability handling, ENISA notification. Your Series A budget does not include €15K for a European compliance consultant. CRACheck generates 8 PDF documents structured under Art. 31 + Annex VII in 15–25 minutes. €149 per product. 100% browser-side.
€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side
Article 3(1) of Regulation (EU) 2024/2847 defines "product with digital elements" as "a software or hardware product and its remote data processing solutions." SaaS products that are marketed as products on the EU market fall within scope. The only exemption is pure processing services with no product component — and most SaaS products are marketed as products, not services.
Article 2(1) of Regulation (EU) 2024/2847 applies to products made available on the EU market, regardless of where the manufacturer is established. If you sell to a single customer in Germany, France, or any EU Member State, the regulation applies. Article 18 allows you to appoint an authorised representative in the EU, but the obligations remain yours.
SOC 2 audits your organisation's controls against the Trust Services Criteria. The CRA requires product-level documentation under Annex VII — including a product-specific cybersecurity risk assessment (Art. 13(2)), an SBOM (Annex VII §2(b)), and a coordinated vulnerability disclosure policy (Annex I Part II §5). SOC 2 addresses organisational controls. Annex VII addresses the product. They cover different dimensions.
8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.
Classification under Annex III/IV. SaaS products with identity management or security functions may fall under Important Class I.
Full Annex VII. The dossier EU enterprise procurement teams are starting to request.
Art. 13(2) + Annex I Part I. Cybersecurity risk assessment specific to your SaaS product's threat model.
Annex II. Includes support period end-date (Art. 13(8): minimum 5 years), vulnerability reporting contact, decommissioning instructions.
Art. 28 + Annex V. As the manufacturer, you sign this.
Annex I Part II §5. Your coordinated vulnerability disclosure policy with response timelines.
Art. 14 ENISA notification. Applies from 11 September 2026.
Sept 2026, Dec 2027, and your product-specific support period milestones.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated from your data, in your browser. No data leaves your device.
Generates your Annex VII dossier. 8 documents. 15–25 minutes. €149. The artefact your EU enterprise client expects in procurement.
Does not determine if the CRA exempts your specific SaaS model (consult a lawyer). Does not appoint your authorised representative under Art. 18. Does not perform the conformity assessment under Art. 32.
We produce the documentation. You handle classification, representation, and conformity assessment.
Article 64 of Regulation (EU) 2024/2847.
Art. 64(2). As the manufacturer, the fine applies directly to you.
Art. 64(3).
Art. 64(4).
| Alternative | Cost | What you get |
|---|---|---|
| European compliance consultant | €10,000–€20,000 | Full audit + documentation. 3–6 months. |
| Build internally | Free + founder time | Weeks of non-product work. No regulatory validation. |
| Drop the EU market | €0 | Lose 30-50% of enterprise pipeline. |
| CRACheck | €149 | 8 documents. 15–25 minutes. Procurement-ready. |
Each CRACheck licence covers one product. If your SaaS portfolio includes 3, 5 or 10 products, each needs its own Annex VII dossier. Contact us for startup volume pricing.
Request Volume PricingCRACheck generates a structured document under Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, precision and completeness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a EU enterprise client in a specific procurement process.
CRACheck is not legal advice. For questions about whether the CRA applies to your specific SaaS model, consult a qualified lawyer or regulatory consultancy.
Eight documents. Annex VII fully structured. Regulation (EU) 2024/2847. Your data stays on your device. The ZIP you download is yours forever.