The Shopify and WooCommerce ecosystem has thousands of Indian developers building plugins for European merchants. Until now, publishing a plugin meant writing code, testing it, and listing it. Regulation (EU) 2024/2847 introduces a new layer: if a plugin is a "product with digital elements" placed on the EU market, the manufacturer obligations under Article 13 apply. Whether that manufacturer is you (if you sell the plugin directly) or your merchant client (if they integrate it into their store) — someone needs the Annex VII documentation. CRACheck generates 8 PDFs in 15–25 minutes. €149 per plugin. 100% browser-side.
€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side
Shopify is a platform provider and, for its own products, a manufacturer. But your plugin is your product. If you market it under your name on the Shopify App Store, you are the manufacturer under Article 3(1) of Regulation (EU) 2024/2847. Shopify does not assume your CRA obligations. Shopify's terms will likely require you to comply independently.
Regulation (EU) 2024/2847 does not include a minimum size, revenue, or user count threshold. Article 2(1) applies to any product with digital elements with a data connection on the EU market. A plugin with 50 European users and a plugin with 50,000 European users have the same documentation obligation. The enforcement risk differs, but the legal obligation is identical.
Article 3(37) of Regulation (EU) 2024/2847 defines "free and open-source software" as software distributed under a licence that provides access to source code. However, Recital 18 clarifies that the exemption applies only when the software is not supplied in the course of a commercial activity. If you sell your WooCommerce plugin — even under an open-source licence — the commercial activity brings it into scope.
8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.
Plugin classification under Annex III/IV. Payment-related plugins may be Important Class I.
Annex VII for the plugin: architecture, API integrations, data flows, third-party dependencies.
Art. 13(2) risk assessment for the plugin's specific threat surface: XSS, injection, data leakage, API key exposure.
Annex II. Plugin installation instructions, security configuration, support period, vulnerability reporting contact.
Art. 28 + Annex V.
Annex I Part II §5. Vulnerability disclosure for the plugin.
Art. 14 ENISA notification. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.
Enforcement dates.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated from your data, in your browser. No data leaves your device.
Generates Annex VII documentation for your plugin. 8 PDFs. 15–25 minutes. €149. Proof of CRA readiness for merchants and marketplaces.
Does not determine whether your specific plugin is in scope (consult a lawyer for borderline cases). Does not review your plugin's code for vulnerabilities. Does not interact with Shopify or WooCommerce approval processes.
We document. You ship.
Article 64 of Regulation (EU) 2024/2847.
Art. 64(2).
Art. 64(3).
Art. 64(4).
| Alternative | Cost | What you get |
|---|---|---|
| EU regulatory consultant | €3,000–€6,000 | Full review per plugin. 4–8 weeks. |
| Write documentation yourself from the regulation text | Free + days | No guarantee the format matches Annex VII. |
| Remove European users from your plugin listing | €0 | Lose the EU market. Revenue drops. |
| CRACheck | €149 | 8 documents. 15–25 min. Annex VII structured. |
Each plugin needs its own Annex VII documentation. If you maintain 5, 10 or 20 plugins for the EU market, contact us for developer volume pricing.
Request Volume PricingCRACheck generates a structured document under Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy is your responsibility as the plugin developer.
We guarantee the structure follows Annex VII and the legal references are correct. We do not guarantee acceptance by Shopify, WooCommerce, or a market surveillance authority.
CRACheck is not legal advice. For borderline cases — such as whether a purely cosmetic theme requires CRA documentation — consult a qualified lawyer.
Eight documents. Annex VII fully structured. Regulation (EU) 2024/2847. Your data stays on your device. The ZIP you download is yours forever.