The European Commission estimated that approximately 90% of products with digital elements fall into the default category — they are not listed as Important (Annex III) or Critical (Annex IV). For these products, Article 32(1) offers four conformity assessment paths, including Module A: internal control. Module A means you, the manufacturer, take sole responsibility. You draw up technical documentation per Annex VII, perform the cybersecurity risk assessment per Article 13(2), issue the EU declaration of conformity per Article 28, and affix CE marking. CRACheck structures this entire process. Eight documents, 15–25 minutes, €149.
€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side
You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.
Annex III is a closed list. If your product falls under any of the 19 Class I or 4 Class II categories, it is Important regardless of your risk assessment. Article 32(2) and (3) impose stricter conformity assessment. Misclassifying to use Module A is a violation that market surveillance authorities will identify.
Module A under Annex VIII, Part I does not reduce the scope of essential cybersecurity requirements. All 13 requirements in Part I of Annex I and all 8 vulnerability handling requirements in Part II apply in full. Module A only means you verify compliance internally rather than through a notified body.
Article 13(5) requires manufacturers to exercise due diligence when integrating third-party components. Module A requires the manufacturer — not the component supplier — to declare conformity of the finished product.
8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.
Confirms whether your product is default, Important (Class I or II per Annex III), or Critical (Annex IV). For default products, this document is your classification rationale — keep it in the technical file.
Per Article 31 and Annex VII. For Module A, Annex VIII Part I, point 2 requires the manufacturer to draw up the documentation described in Annex VII. This is the core deliverable.
Per Article 13(2) and (3). Even for default products, the risk assessment must map against all applicable requirements in Part I of Annex I.
Per Annex II. Default products carry the same user information obligations as Important or Critical products.
Per Article 28 and Annex V. Under Module A, you draw up the declaration on your sole responsibility. No notified body identification number needed.
Per Part II, point (5) of Annex I. Required for all categories, including default.
Article 14 structure for ENISA reporting. Required from 11 September 2026 regardless of product category. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.
Key dates and support period milestones specific to your default-category product.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated from your data, in your browser. No data leaves your device.
Module A means you declare conformity on your sole responsibility. That responsibility is backed by the technical documentation per Annex VII, the risk assessment per Article 13(2)–(3), and the declaration per Article 28. CRACheck generates these documents.
All essential cybersecurity requirements in Annex I apply to default products. Module A only changes who verifies: you, not a notified body. Security updates, vulnerability handling, SBOM, ENISA reporting — all are mandatory regardless of the assessment path.
Module A is the most efficient path. It is not the easiest path in terms of obligations. The documentation must be robust because you are the sole verifier.
Article 64 of Regulation (EU) 2024/2847.
Non-compliance with Annex I or Articles 13/14.
Non-compliance with Art. 31, Art. 28, Art. 32.
Misleading information to authorities.
| Criterion | Module A (internal) | Module B+C (EU-type + production) | Module H (full quality) | EU cybersecurity certification |
|---|---|---|---|---|
| Applicable to | Default products (Art. 32(1)(a)) | Important Class I/II (Art. 32(2)–(3)) | Class I/II (Art. 32(2)–(3)) | Where available (Art. 32(1)(d)) |
| Notified body required | No | Yes (Module B) | Yes (Module H) | Yes (certification body) |
| Cost | €149 (CRACheck documentation) | €5K–€15K (notified body fees) | €8K–€20K (notified body fees) | Variable |
| Timeline | 15–25 minutes for documentation | 3–6 months | 3–6 months | Variable |
Each product needs its own Module A documentation set. Pack of 10: €99 per product. Pack of 30: €79 per product.
Request Volume PricingCRACheck generates a structured document based on Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you input. The accuracy of that information is your responsibility as the manufacturer, particularly under Module A where you bear sole verification responsibility.
We guarantee that the document structure follows Article 31 and Annex VII and that all cited legal references are correct. We do not guarantee acceptance by any market surveillance authority in a specific case.
CRACheck is not legal advice. For questions about your product's classification or applicable conformity assessment procedure, consult a qualified regulatory professional.
Eight documents. Article 31 + Annex VII fully structured. Regulation (EU) 2024/2847. Your data stays on your device. The ZIP you download is yours forever.