Does the EU-Turkey customs union mean the CRA automatically applies in Turkey?

Not directly. The customs union requires Turkey to align with EU harmonisation legislation for industrial products, but the transposition of new regulations into Turkish law follows a separate process. Regardless of domestic transposition, Regulation (EU) 2024/2847 applies to any product placed on the EU market. If you export to the EU, your products must comply with the CRA by the enforcement date, independent of whether Turkey has adopted it domestically.

Do we need an authorised representative in the EU?

Article 18 allows manufacturers outside the EU to appoint an authorised representative within the EU by written mandate. While not strictly mandatory, having an authorised representative facilitates communication with market surveillance authorities and demonstrates commitment to compliance. Your EU importer may separately carry obligations under Article 19.

We already hold CE marking for our appliances. Is the CRA Declaration separate?

Yes. The Declaration of Conformity under Article 28 + Annex V of the CRA is a separate document from your LVD, EMC, or RED Declarations. Your product will reference the CRA as an additional legal basis for CE marking. CRACheck generates this CRA-specific Declaration.

Will Turkish notified bodies be able to certify CRA compliance?

Notified bodies under the CRA are designated by EU Member States. As of now, Turkish certification bodies would need to be recognised under the CRA's notification framework (Articles 35–40) to perform CRA conformity assessments. For Default products using Module A (self-assessment), no notified body is required. For Important products requiring third-party assessment, you would need an EU-notified body.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Under Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation is amended?

Regenerate at no additional cost during licence validity.

You manufacture connected household appliances in Turkey and export them to the European Union under the customs union framework. The Cyber Resilience Act is a product regulation — Regulation (EU) 2024/2847 — that applies to any product with digital elements placed on the EU market, regardless of the manufacturer's location. Your existing CE marking does not cover CRA cybersecurity requirements. CRACheck generates the missing documentation.

Turkish appliance manufacturers are deeply integrated into the EU market. The customs union covers industrial products under existing harmonisation directives. But the Cyber Resilience Act is a new regulation with new requirements. It adds cybersecurity documentation obligations — Annex VII technical file, Annex I essential requirements, Art. 14 vulnerability reporting — on top of your existing CE framework. Your EU importers and retailers will need to verify this documentation under Article 19 and Article 20 before placing your products on the market after 11 December 2027. CRACheck generates the 8-document dossier in 15–25 minutes. €149 per appliance model. All data stays in your browser.

Generate CRA dossier — €149 Free: check your product classification

€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side

Key numbers

11 Dec 2027

Deadline for CRA compliance — connected appliances

Art. 19

EU importers must verify manufacturer compliance

€149

Per appliance model, one-time payment

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Classify your appliance

CRACheck determines whether your connected product is Default or Important Class I (Annex III item 17 for smart home products with security functionalities)

Enter appliance specifications

Connectivity type, firmware version, app connectivity, data processing, user authentication mechanisms

Map your cybersecurity implementation

How your appliance meets Annex I requirements: encryption, secure defaults, OTA updates, data minimisation, factory reset

Document vulnerability handling

Your incident response process, firmware patch distribution, coordinated disclosure policy

Set your support period

At least 5 years of security updates from market placement, or the expected product lifetime if shorter (Art. 13(8))

Generate the 8-document dossier

Structured for your appliance category, aligned with Art. 31 + Annex VII

Include in your EU export package

The CRA dossier complements your existing CE technical file for LVD, EMC, RED, RoHS

Common mistakes

❌

CUSTOMS UNION CONFUSION

"The EU-Turkey customs union means we automatically comply with the CRA"

The customs union covers the free movement of industrial goods and alignment with certain EU harmonisation directives. Regulation (EU) 2024/2847 is a new regulation that Turkey has not yet transposed into domestic law. Even under the customs union, Turkish manufacturers placing products on the EU market must comply with all applicable EU product regulations. The CRA applies based on market placement, not manufacturer location.

❌

EXISTING CE RELIANCE

"Our CE marking under LVD and RED already covers the cybersecurity aspect"

CE marking under the Low Voltage Directive, EMC Directive, or Radio Equipment Directive addresses electrical safety, electromagnetic compatibility, and specific radio requirements. None of these covers the full scope of the CRA's cybersecurity essential requirements (Annex I), vulnerability handling obligations (Art. 14), or technical documentation structure (Annex VII). The CRA adds a separate, parallel layer.

❌

RETAILER ASSUMPTION

"Our EU retailer or distributor will handle the CRA paperwork"

Under Article 20, distributors must verify that the manufacturer has complied with CRA obligations — not create documentation on the manufacturer's behalf. Under Article 19, importers must ensure that the conformity assessment has been carried out and that technical documentation exists before placing the product on the market. Both are verification roles. The documentation obligation is yours as manufacturer under Article 13.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Classifies your connected appliance. Smart home products with security functionalities (Annex III Class I, item 17) include devices with smart locks, security cameras, or alarm functions. Determines your conformity assessment path.

Technical Documentation

Art. 31 + Annex VII dossier: appliance design, connectivity architecture, firmware management, security features, production quality controls.

Risk Assessment

Annex I Part I cybersecurity risk analysis for connected household appliances: remote access risks, data exposure, firmware tampering, physical interface attacks.

User Information

Annex II consumer documentation in the language required by the destination market: secure setup guide, password management, update instructions, factory reset procedure, support contact.

Declaration of Conformity

Art. 28 + Annex V. A separate CRA Declaration alongside your existing LVD, EMC, and RED Declarations.

CVD Policy

How consumers and security researchers report vulnerabilities in your appliances. Response timelines and patch distribution process.

Notification Template

Art. 14 ENISA notification: 24h early warning, 72h notification, 14-day final report for actively exploited vulnerabilities.

Obligations Calendar

CRA enforcement dates, your model-specific support period, firmware update milestones.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 TURKISH OR EU COMPLIANCE CONSULTANCY

€8,000–€20,000

6–12 weeks. Requires sharing product design with external firm. CRA-specific expertise scarce in the Turkish consultancy market. Separate engagement for each product line.

✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history