Industrial IoT devices operate in environments where cybersecurity has operational safety implications. A compromised temperature sensor in a pharmaceutical cold chain can cause product loss. A compromised gateway in a factory network can expose the entire OT environment. European industrial buyers — manufacturers, utilities, logistics companies — are adding CRA compliance clauses to procurement contracts for IoT equipment. Article 31 and Annex VII of Regulation (EU) 2024/2847 require technical documentation covering vulnerability handling, risk assessment and SBOM. CRACheck generates 8 PDF documents. 15-25 minutes. €149 per product. Browser-side.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
Your EU industrial client's procurement team has already added the CRA clause. Have the documentation ready.
Your EU industrial client's procurement team has already added the CRA clause. Have the documentation ready.
Article 2.1 of Regulation (EU) 2024/2847 applies to products with digital elements made available on the EU market. It does not distinguish B2B from B2C. An industrial sensor sold to a German factory integrator is placed on the EU market. CRA applies.
Annex I Part I point 1(d) requires secure by default configuration. Default MQTT credentials (admin/admin, root/root) are the exact pattern the CRA targets. The product must ship with unique credentials or require credential setup before operation. The integrator's deployment process does not absolve the manufacturer.
Article 13.8 requires the manufacturer to provide security updates for a support period reflecting expected use. Industrial IoT devices are deployed for 10-15 years. A 3-year support period means 7-12 years without manufacturer security updates. EU industrial buyers will not accept this. Document a support period aligned with industrial expectations.
Industrial IoT devices have unique cybersecurity requirements: industrial protocols, long lifecycles, OT network exposure. CRACheck generates 8 documents covering these specifics.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No product data is transmitted to any server.
Generates Annex VII documentation for your industrial IoT device. Covers industrial protocols, edge processing, OTA updates, long support period declaration.
CRACheck does not perform IEC 62443 assessment, penetration testing of industrial protocols or OT network security audits. CRA documentation is one layer. Industrial cybersecurity certification (IEC 62443) is another.
We generate CRA documentation. You pursue IEC 62443 certification separately if needed.
Article 64 establishes three tiers of administrative fines. Penalties are calculated per undertaking — but non-compliance on a single product can trigger inspection of your entire portfolio.
Art. 64.2. Up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.
Art. 64.3. Up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Includes failure to produce Annex VII documentation.
Art. 64.4. Up to €5 million or 1% of total worldwide annual turnover, whichever is higher.
Art. 64.5 accounts for the nature, gravity and duration of the infringement, and gives consideration to microenterprises, small and medium-sized enterprises, including start-ups.
| Alternative | Cost | What you get |
|---|---|---|
| Industrial cybersecurity consultancy | €15,000–€40,000 | IEC 62443 + CRA. 4-8 months. |
| Provide product datasheet as documentation | €0 | Datasheet is not Annex VII documentation. |
| Wait for procurement enforcement | €0 now | Lose tenders. Industrial integrators buy from compliant suppliers. |
| CRACheck | €149 | 8 CRA docs. 15 min. Per product model. |
Each product model needs its own CRA dossier. Temperature sensor, humidity sensor, LoRa gateway, LTE gateway, edge controller — five products, five dossiers. Volume pricing: €99/product (10-pack), €79/product (30-pack).
Request volume pricingCRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness and truthfulness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct as of the last verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a commercial buyer in a procurement process.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.