Is the CRA documentation requirement really the same for a 10-person company and a 10,000-person company?

Yes. Article 31(1) requires the technical documentation to contain at least the elements set out in Annex VII, regardless of manufacturer size. Article 33 acknowledges the burden on SMEs and requires Member States to provide support, but it does not reduce the documentation scope. Article 32(6) requires proportionate conformity assessment fees for SMEs.

Are there any exemptions for microenterprises?

The only express penalty exemption is Article 64(10)(a), which exempts manufacturers qualifying as microenterprises or small enterprises from fines for failing to meet the 24-hour early warning deadline under Article 14(2)(a). All other obligations apply in full.

What if I only sell B2B, not to consumers?

The CRA applies to products with digital elements made available on the EU market regardless of the end user. Article 2(1) defines scope by market placement, not by the consumer/business distinction.

Can I use CRACheck for products in different categories?

Yes. The Product Classifier runs for each product individually. If one product is default (Module A) and another is Important Class I (Annex III), CRACheck generates the documentation for both.

How does the €149 compare to the potential fine?

Article 64(2) sets fines at up to €15,000,000 or 2.5% of global annual turnover. For a company with €500,000 annual revenue, the 2.5% cap means a maximum fine of €12,500. The cost-benefit of €149 documentation versus five-figure enforcement risk requires no further calculation.

Is this a subscription?

No. One-time payment. 30 days of editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate with the updated version at no additional cost during licence validity.

A regulatory consultant just quoted you €15,000 to prepare the technical documentation that Article 31 of Regulation (EU) 2024/2847 requires for your connected product. Your team is twelve people. That quote is your entire Q3 compliance budget. CRACheck costs €149.

The Cyber Resilience Act does not scale its documentation requirements by company size. A manufacturer with 10 employees must produce the same Annex VII technical file as a manufacturer with 10,000. Article 33 acknowledges this asymmetry and requires Member States to support SMEs, but the obligation remains. CRACheck lets you meet that obligation at a cost proportionate to your revenue. Eight documents, 15–25 minutes, €149 one-time. No subscription, no consultant dependency, no data leaving your device.

Generate CRA documentation — €149 Free: check your product classification

€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side

Key numbers

€149

one-time cost for full CRA documentation package — vs. €12K–€20K consultant average

15 min

to generate 8 PDF documents structured per Annex VII

data transmitted to external servers — 100% browser-side processing

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Get a consultant quote

Average: €12,000–€20,000. Timeline: 8–16 weeks. For a 10-person company, that may exceed the annual compliance budget.

Try the alternative

Open CRACheck. No account required. No onboarding call. No NDA to sign.

Classify your product

The Product Classifier determines whether your product is default, Important Class I/II (Annex III), or Critical (Annex IV).

Fill in product data

Describe your product's purpose, connectivity, data processing, and security measures. CRACheck maps your answers to Annex I.

Generate documentation

Eight documents compiled in 15–25 minutes. Technical documentation per Annex VII, risk assessment per Article 13(2), declaration of conformity per Article 28.

Review and refine

30 days to edit. 10 regenerations. If you spot a gap, fix it and regenerate.

Common mistakes

❌

COST TRAP

"Delaying compliance to save money now"

Article 64(2) sets fines at up to €15,000,000 or 2.5% of global annual turnover for non-compliance with Articles 13 and 14. For a company with €2M annual revenue, that is a potential €50,000 fine. The €149 documentation cost is a rounding error compared to the enforcement risk after 11 December 2027.

❌

SCOPE MISUNDERSTANDING

"Believing small companies are exempt from the CRA"

Regulation (EU) 2024/2847 applies to all manufacturers who place products with digital elements on the EU market, regardless of company size (Article 2(1)). Article 33 provides support measures for SMEs but does not exempt them from any obligation. The only relief is Article 64(10), which exempts micro and small enterprises from the 24-hour early warning penalty under Article 14(2)(a).

❌

DOCUMENTATION GAP

"Using a CE Declaration without the technical file behind it"

Article 13(12) requires manufacturers to first draw up the technical documentation under Article 31, then carry out the conformity assessment under Article 32, and only then draw up the EU declaration of conformity and affix CE marking. The declaration without the technical file is a compliance gap that Article 64(3) penalises at up to €10M or 2%.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Identifies where your product sits in the CRA classification: default (Module A self-assessment), Important Class I or II (Annex III, may need notified body), or Critical (Annex IV). Determines cost implications for the next steps.

Technical Documentation

The core deliverable. Structured per Article 31 and Annex VII's eight mandatory elements. This is the document a market surveillance authority will request first.

Risk Assessment

Maps your product's cybersecurity risks per Article 13(2) and (3) against the 13 requirements in Part I of Annex I. Without this, the technical documentation is incomplete.

User Information

The nine-point information sheet per Annex II that must accompany your product.

Declaration of Conformity

Per Article 28 and the Annex V model structure. The formal statement that your product meets the essential cybersecurity requirements.

CVD Policy

Coordinated vulnerability disclosure policy required by Part II, point (5) of Annex I. Establishes your contact address and response process.

Notification Template

Pre-structured for ENISA notifications per Article 14. Three tiers: 24-hour early warning, 72-hour notification, 14-day final report. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Timeline with Article 14 reporting (from 11 September 2026), full application (11 December 2027), and your product's support period milestones.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 CONSULTANT ENGAGEMENT

€12,000–€20,000

2–4 months. Requires staff time for interviews and reviews. Scope creep common. Each regulatory update triggers a new invoice.

✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history