The conformity assessment decision tree under the CRA has four branches. Article 32(1) covers default products: any procedure including Module A (self-assessment). Article 32(2) covers Important Class I without harmonised standards: Module B+C or Module H (notified body required). Article 32(3) covers Important Class II: Module B+C, Module H, or European cybersecurity certification at assurance level "substantial" (notified body or certification body required). Article 32(4) covers Critical products listed in Annex IV: European cybersecurity certification per Article 8(1), or, if unavailable, the Class II procedures. In all four branches, technical documentation per Article 31 and Annex VII is the prerequisite. CRACheck generates that documentation. Eight documents, 15–25 minutes, €149.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
The classification determines whether you need only documentation or both documentation and external assessment.
Article 32(2) of Regulation (EU) 2024/2847 makes Module A conditional for Important Class I products: it is only available when harmonised standards, common specifications, or European cybersecurity certification schemes at assurance level "substantial" have been applied in full. If you have applied them partially or not at all, Module A is not available.
Article 32(3) does not include Module A as an option for Class II products. The available procedures are Module B+C, Module H, or European cybersecurity certification at assurance level "substantial." There is no harmonised-standards carve-out that unlocks Module A for Class II.
Article 32(4) requires European cybersecurity certification only for Critical products listed in Annex IV. For all other products — default, Class I, and Class II — the certification scheme is an option but not a requirement.
Every conformity assessment path starts with the same documentation. CRACheck generates the complete 8-document package.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No data is transmitted to any server.
CRACheck first classifies your product (default / Class I / Class II / Critical) and identifies the applicable Article 32 paragraph. Then it generates the Annex VII documentation that the applicable procedure requires as input. Whether you self-assess under Module A or submit to a notified body under Module B, the documentation is the same structure.
For Class I without harmonised standards, Class II, and Critical products, the conformity assessment includes steps that only a notified body or certification body can perform: EU-type examination (Module B), quality system assessment (Module H), or European cybersecurity certification. CRACheck does not substitute these external assessments.
CRACheck classifies and documents. The notified body examines and certifies. The classification determines whether you need only the first step or both.
Article 64 establishes three tiers of administrative fines.
Art. 64.2. Up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.
Art. 64.3. Includes failure to produce Annex VII documentation.
Art. 64.4.
Using an incorrect conformity assessment procedure does not just invalidate the procedure — it invalidates the CE marking, the declaration of conformity, and the market placement. Article 64(3) applies to violations of Articles 28, 31, and 32.
| Product category | Module A available? | Notified body required? |
|---|---|---|
| Default (not in Annex III/IV) | Yes | No — CRACheck is the complete solution |
| Important Class I (with harmonised standards) | Yes | No — CRACheck is the complete solution |
| Important Class I (without harmonised standards) | No | Yes (Module B+C or H) — CRACheck generates input to NB |
| Important Class II | No | Yes (Module B+C, H, or certification) — CRACheck generates input |
| Critical (Annex IV) | No | Yes (certification or B+C/H fallback) — CRACheck generates input |
Each product may require a different conformity assessment path. CRACheck classifies and documents each one independently. Pack of 10: €99 per product.
Request volume pricingCRACheck generates a structured document based on Article 31 and Annex VII of Regulation (EU) 2024/2847 from the data you provide, including the product classification that determines the applicable conformity assessment procedure. The accuracy of the product description and classification inputs is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII, that the Product Classifier maps against the categories in Annexes III and IV, and that all cited legal references are correct. We do not guarantee that a notified body will accept the classification or that a market surveillance authority will confirm the applicable procedure in a specific case.
CRACheck is not legal advice. For products near the boundary between categories (e.g., a device with VPN functionality that may trigger Annex III Class I, point 5), consult a qualified regulatory specialist.