CRA for Turkish Smart Appliance Manufacturers

Key numbers

11 Dec 2027

Deadline for CRA compliance — connected appliances

Art. 19

EU importers must verify manufacturer compliance

€149

Per appliance model, one-time payment

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Classify your appliance

CRACheck determines whether your connected product is Default or Important Class I (Annex III item 17 for smart home products with security functionalities)

Enter appliance specifications

Connectivity type, firmware version, app connectivity, data processing, user authentication mechanisms

Map your cybersecurity implementation

How your appliance meets Annex I requirements: encryption, secure defaults, OTA updates, data minimisation, factory reset

Document vulnerability handling

Your incident response process, firmware patch distribution, coordinated disclosure policy

Set your support period

At least 5 years of security updates from market placement, or the expected product lifetime if shorter (Art. 13(8))

Generate the 8-document dossier

Structured for your appliance category, aligned with Art. 31 + Annex VII

Include in your EU export package

The CRA dossier complements your existing CE technical file for LVD, EMC, RED, RoHS

Common mistakes

❌

CUSTOMS UNION CONFUSION

"The EU-Turkey customs union means we automatically comply with the CRA"

The customs union covers the free movement of industrial goods and alignment with certain EU harmonisation directives. Regulation (EU) 2024/2847 is a new regulation that Turkey has not yet transposed into domestic law. Even under the customs union, Turkish manufacturers placing products on the EU market must comply with all applicable EU product regulations. The CRA applies based on market placement, not manufacturer location.

❌

EXISTING CE RELIANCE

"Our CE marking under LVD and RED already covers the cybersecurity aspect"

CE marking under the Low Voltage Directive, EMC Directive, or Radio Equipment Directive addresses electrical safety, electromagnetic compatibility, and specific radio requirements. None of these covers the full scope of the CRA's cybersecurity essential requirements (Annex I), vulnerability handling obligations (Art. 14), or technical documentation structure (Annex VII). The CRA adds a separate, parallel layer.

❌

RETAILER ASSUMPTION

"Our EU retailer or distributor will handle the CRA paperwork"

Under Article 20, distributors must verify that the manufacturer has complied with CRA obligations — not create documentation on the manufacturer's behalf. Under Article 19, importers must ensure that the conformity assessment has been carried out and that technical documentation exists before placing the product on the market. Both are verification roles. The documentation obligation is yours as manufacturer under Article 13.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Classifies your connected appliance. Smart home products with security functionalities (Annex III Class I, item 17) include devices with smart locks, security cameras, or alarm functions. Determines your conformity assessment path.

Technical Documentation

Art. 31 + Annex VII dossier: appliance design, connectivity architecture, firmware management, security features, production quality controls.

Risk Assessment

Annex I Part I cybersecurity risk analysis for connected household appliances: remote access risks, data exposure, firmware tampering, physical interface attacks.

User Information

Annex II consumer documentation in the language required by the destination market: secure setup guide, password management, update instructions, factory reset procedure, support contact.

Declaration of Conformity

Art. 28 + Annex V. A separate CRA Declaration alongside your existing LVD, EMC, and RED Declarations.

CVD Policy

How consumers and security researchers report vulnerabilities in your appliances. Response timelines and patch distribution process.

Notification Template

Art. 14 ENISA notification: 24h early warning, 72h notification, 14-day final report for actively exploited vulnerabilities.

Obligations Calendar

CRA enforcement dates, your model-specific support period, firmware update milestones.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 TURKISH OR EU COMPLIANCE CONSULTANCY

€8,000–€20,000

6–12 weeks. Requires sharing product design with external firm. CRA-specific expertise scarce in the Turkish consultancy market. Separate engagement for each product line.

✓ CRACHECK

€149

8 documents. 15–25 min. 100% browser-side — product specs stay internal. 10 regenerations for model updates. Pack 10: €99/model. Pack 30: €79/model.

Two layers

● LAYER 1

CRA documentation for EU market access

CRACheck generates the Art. 31 + Annex VII cybersecurity dossier that your EU importers and distributors will verify under Articles 19 and 20. It classifies your appliance, structures your security measures against Annex I, and produces 8 PDFs that sit alongside your existing CE technical file. This is the documentation layer that the CRA adds to your export requirements.

∅ LAYER 2

Product security engineering

CRACheck does not implement encryption in your appliance's firmware, design your OTA update mechanism, or build authentication features. If your connected appliance does not yet meet the essential cybersecurity requirements of Annex I Part I, the engineering work must happen before the documentation can accurately reflect compliance.

Turkish manufacturers already integrated into EU supply chains need Layer 1 now. Your importers and retailers will start requesting CRA documentation well before the December 2027 deadline.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Essential requirements + manufacturer obligations (Art. 64(2))

€15,000,000 / 2.5%

Annex I + Art. 13/14.

🟠

Documentation and conformity obligations (Art. 64(3))

€10,000,000 / 2%

Art. 28, 31, 32.

🟡

Misleading information (Art. 64(4))

€5,000,000 / 1%

Misleading information.

Alternatives

Criterion	Turkish Compliance Firm	EU Compliance Firm	Internal Team	CRACheck
Time per model	6–12 weeks	8–16 weeks	4–10 weeks	15–25 minutes
Cost	€8,000–€15,000	€12,000–€20,000	Staff allocation	€149
CRA expertise	Limited (new regulation)	Variable	Learning curve	Built-in Annex VII structure
Data sovereignty	Shared locally	Shared with EU firm	Internal	100% browser-side

Full appliance range for the EU market?

Turkish manufacturers typically export multiple connected appliance models to Europe. Each model with distinct connectivity and firmware requires its own CRA dossier. Volume pricing: €99/model (pack 10), €79/model (pack 30).

Request Volume Pricing

Each appliance model with distinct digital elements needs its own dossier.

What CRACheck guarantees and what it does not

CRACheck generates a structured document aligned with Article 31 and Annex VII of Regulation (EU) 2024/2847 based on the appliance data you provide. The accuracy of that data is your responsibility as manufacturer.

We guarantee the document structure follows Art. 31 + Annex VII and that all cited legal references are correct. We do not guarantee acceptance by an EU market surveillance authority or importer in a particular case.

CRACheck is not legal advice. For questions about the customs union's interaction with the CRA, Annex III classification, or the need for an EU authorised representative under Article 18, consult a regulatory attorney.

Frequently asked questions

Does the EU-Turkey customs union mean the CRA automatically applies in Turkey?

Not directly. The customs union requires Turkey to align with EU harmonisation legislation for industrial products, but the transposition of new regulations into Turkish law follows a separate process. Regardless of domestic transposition, Regulation (EU) 2024/2847 applies to any product placed on the EU market. If you export to the EU, your products must comply with the CRA by the enforcement date, independent of whether Turkey has adopted it domestically.

Do we need an authorised representative in the EU?

Article 18 allows manufacturers outside the EU to appoint an authorised representative within the EU by written mandate. While not strictly mandatory, having an authorised representative facilitates communication with market surveillance authorities and demonstrates commitment to compliance. Your EU importer may separately carry obligations under Article 19.

We already hold CE marking for our appliances. Is the CRA Declaration separate?

Yes. The Declaration of Conformity under Article 28 + Annex V of the CRA is a separate document from your LVD, EMC, or RED Declarations. Your product will reference the CRA as an additional legal basis for CE marking. CRACheck generates this CRA-specific Declaration.

Will Turkish notified bodies be able to certify CRA compliance?

Notified bodies under the CRA are designated by EU Member States. As of now, Turkish certification bodies would need to be recognised under the CRA's notification framework (Articles 35–40) to perform CRA conformity assessments. For Default products using Module A (self-assessment), no notified body is required. For Important products requiring third-party assessment, you would need an EU-notified body.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Under Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation is amended?

Regenerate at no additional cost during licence validity.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.