Telecom equipment manufacturers face a regulatory stack: RED (2014/53/EU) for radio and EMC, including delegated cybersecurity requirements under Art. 3(3)(d)-(f). The CRA (Regulation (EU) 2024/2847) for horizontal cybersecurity covering vulnerability handling, support periods, SBOM, ENISA reporting and Art. 31 technical documentation. Art. 12 of the CRA addresses overlap with other Union law, and Art. 2(5) allows the Commission to limit or exclude CRA scope where sectoral rules achieve equivalent protection — but no delegated act has been adopted yet. Until then, both apply. Annex III classifies routers, modems and switches as Important Class I (item 12) and network management systems as Important Class I (item 6). For Important Class I products where harmonised standards are not fully applied, Art. 32(2) may require EU-type examination or full quality assurance instead of internal control alone. CRACheck generates the 8-document technical file. €149 per product. 15-25 minutes.
€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side
RED delegated cybersecurity requirements under Art. 3(3)(d)-(f) of Directive 2014/53/EU address specific security aspects of radio equipment. The CRA's Annex I requirements are broader: vulnerability handling, SBOM, support period, coordinated disclosure, ENISA reporting, technical documentation under Annex VII. Until the Commission adopts a delegated act under Art. 2(5) of the CRA, both regulatory layers coexist.
Art. 32(2) of Regulation (EU) 2024/2847 restricts conformity assessment for Important Class I products. If harmonised standards applicable to the CRA have not been published or you have not fully applied them, internal control (Module A) is insufficient. EU-type examination (Module B+C) or full quality assurance (Module H) is required.
Art. 13(3) of Regulation (EU) 2024/2847 requires the risk assessment to cover intended purpose and reasonably foreseeable use. For telecom equipment deployed in 5G infrastructure, the foreseeable use includes integration into critical national infrastructure. A risk assessment scoped to the standalone device without addressing network-level impact is incomplete.
8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.
Identifies Important Class I (routers, switches per Annex III item 12; network management per item 6), Important Class II (firewalls, IDS/IPS per Annex III items 1-2), or Default for ancillary telecom products.
Art. 31 and Annex VII documentation for telecom equipment: network architecture, firmware structure, management interface security, protocol specifications, supply chain component data.
Cybersecurity risk assessment covering telecom-specific vectors: network infrastructure compromise, remote management exploitation, firmware supply chain attacks, protocol-level vulnerabilities.
Annex II information for telecom operator deployment: secure configuration, hardening guidelines, update mechanisms, vulnerability reporting, support period.
EU Declaration per Art. 28 and Annex V.
Coordinated vulnerability disclosure policy aligned with telecom industry CERT practices.
ENISA notification template per Art. 14 with telecom infrastructure urgency context.
Key dates: Art. 14 from September 2026, full enforcement December 2027, harmonised standards publication timeline.
See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.
Generated from your data, in your browser. No data leaves your device.
CRACheck generates the Art. 31 and Annex VII documentation for the Cyber Resilience Act requirements that RED does not address. Vulnerability handling processes, SBOM, coordinated disclosure, ENISA notification template, support period definition, obligations calendar. Eight documents per product.
CRACheck does not perform RED testing (radio, EMC, safety). It does not conduct EU-type examination for Important Class I products under Art. 32(2). It does not engage notified bodies. It does not perform network security testing on your 5G infrastructure. It does not produce NIS2 documentation for your operator clients.
RED covers the radio. NIS2 covers the operator. The CRA covers the product. CRACheck documents the CRA layer.
A vulnerability in 5G infrastructure components triggers 24h ENISA notification. For telecom, the systemic impact amplifies reporting urgency.
Telecom equipment on the EU market must carry CRA-compliant CE marking and Art. 31 documentation. Operator procurement will require both RED and CRA evidence.
For telecom manufacturers non-compliant with Art. 13, Art. 14 or Annex I. Separate from any RED enforcement action.
| Criterio | Telecom compliance consultancy | RED-only approach | Internal regulatory team | CRACheck |
|---|---|---|---|---|
| Price | €20K-50K | Does not cover CRA | Staff time | €149 per product |
| CRA Art. 31 coverage | Report | None | Depends | 8-document technical file |
| Vulnerability handling documented | Possibly | No | Possibly | Yes — CVD + ENISA template |
| Operator NIS2 evidence | Indirect | No | Possibly | Structured for supply chain review |
| CRACheck | €149 | Yes | CVD+ENISA | Structured |
Pack 10: €99 per product. Pack 30: €79 per product. For telecom equipment manufacturers with broad EU product portfolios, contact us for enterprise pricing.
Request volume pricingCRACheck generates a structured document set according to Art. 31 and Annex VII of Regulation (EU) 2024/2847 based on the information you provide. The accuracy of network architecture, firmware data and component inventories is your responsibility as manufacturer.
We guarantee that the document structure follows Art. 31 and Annex VII and that the legal references cited are correct. We do not determine your conformity assessment route under Art. 32, nor do we guarantee acceptance by a notified body, market surveillance authority or telecom operator.
CRACheck is not legal advice. For the CRA/RED interaction, conformity assessment route selection for Important Class I products, and NIS2 supply chain implications, consult a qualified telecom regulatory lawyer.
Routers, switches, network management — Important Class I under Annex III. Eight documents per product. €149. Browser-side. Your network architecture never leaves your device.