Items 13 and 14 of Annex III explicitly list microprocessors and microcontrollers with security-related functionalities as Important Class I products. That classification changes your conformity assessment path under Article 32 — you cannot rely on self-assessment alone unless you follow harmonised standards or hold an EU cybersecurity certification at assurance level "substantial." Your EU customers' compliance teams already know this. CRACheck generates the 8-document technical dossier in 15–25 minutes. €149 per chip family. Your design data stays on your machine.
€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side
You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.
If your chip contains embedded firmware, implements security functions (authentication, encryption, secure boot), or processes data, it is a product with digital elements under Article 3(1). Items 13 and 14 of Annex III specifically target microprocessors and microcontrollers with security-related functionalities. A chip with a crypto engine is not a passive component.
Important Class I products can use Module A (internal control, Annex VIII Part I) only if the manufacturer applies harmonised standards covering all essential cybersecurity requirements, or holds an EU cybersecurity certification at assurance level "substantial." Without either, Article 32(2) requires third-party assessment under Module B+C or Module H.
Article 13 assigns obligations to the manufacturer — defined in Article 3(13) as whoever develops or manufactures the product and markets it under their name. If you sell your chip under your own brand to integrators, you are the manufacturer of that component. Your customer's conformity assessment for the final product does not relieve your own obligations for the chip.
8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.
Confirms classification under Annex III. Documents whether it qualifies as Default, Important Class I (items 13–14), or Class II (tamper-resistant variants, items 3–4). Determines conformity assessment obligations under Art. 32.
Art. 31 + Annex VII dossier covering silicon design, firmware architecture, security functions, production processes, and supply chain controls.
Annex I Part I cybersecurity risk analysis. Evaluates threats at the silicon level: side-channel attacks, firmware injection, key extraction, supply chain tampering.
Annex II-compliant package for integrators: secure integration guidelines, firmware update procedures, known limitations, end-of-support timeline.
Art. 28 + Annex V, pre-structured with semiconductor-specific fields: chip family identifier, firmware version matrix, applicable Annex III category.
Coordinated vulnerability disclosure framework. Documents your PSIRT contact, acknowledgement timelines, and coordination protocol with downstream manufacturers.
ENISA notification structure for actively exploited vulnerabilities: 24h early warning, 72h notification, 14-day final report per Art. 14.
Milestones: Art. 14 reporting from 11 September 2026, full enforcement 11 December 2027, firmware support commitment, patch cycle cadence.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated from your data, in your browser. No data leaves your device.