Does Art. 13(5) mean I need cybersecurity documentation from every component supplier?

Article 13(5) requires you to exercise due diligence when integrating components. This means you must take reasonable steps to verify that third-party components do not undermine your product's cybersecurity. Structured documentation from suppliers strengthens your due diligence evidence. Where a supplier cannot provide it, you must document the risk and any mitigating measures you have implemented.

What if an open-source library has a known vulnerability?

As manufacturer of the integrated product, you are responsible for the cybersecurity of the whole system under Article 13. If a known vulnerability exists in an integrated open-source component, your documentation should record it, describe your assessment of its impact, and document any mitigation (patch, workaround, compensating control).

Does the highest-risk component determine my product's classification?

Not directly. Your product's Annex III classification depends on its primary function, not on individual component classifications. However, if your product's primary function matches an Annex III category (e.g., it is a network management system incorporating third-party modules), the product-level classification applies. CRACheck evaluates this at the product level.

How do I handle components from suppliers who refuse to share cybersecurity data?

Document the refusal as part of your due diligence under Art. 13(5). Assess the risk of using that component without supplier cybersecurity documentation. Your Annex VII dossier should record this gap and the compensating measures you have taken. Over time, the CRA will drive supplier selection toward those who can provide adequate documentation.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Under Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent for immediate digital content generation. Refunds only for reproducible technical failures.

What if the regulation is amended?

Regenerate at no additional cost during licence validity.

You source components from multiple suppliers and integrate them into a connected product sold in the European Union. Article 13(5) of Regulation (EU) 2024/2847 requires you to exercise due diligence when integrating third-party components. Your Annex VII technical documentation must cover the entire product — including the components you did not design. CRACheck structures the complete dossier.

Component integration is where CRA compliance gets complex. You are the manufacturer of the final product under Article 3(13). The cybersecurity of your product depends on every component in the stack — the wireless module from Taiwan, the microcontroller firmware from a fabless vendor, the cloud connector library from an open-source project. Article 13(5) requires you to exercise due diligence on each. Your Annex VII documentation must describe the product as a whole, including how third-party components interact with your security architecture. CRACheck generates the 8-document dossier from your specifications. €149 per integrated product. 15–25 minutes. Your bill of materials never leaves your browser.

Generate CRA dossier — €149 Free: check your product classification

€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side

Key numbers

Art. 13(5)

Due diligence obligation for component integration

Annex VII

Documentation must cover the complete product

15 min

Full dossier including component due diligence

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Classify your integrated product

CRACheck determines whether the final product falls under Default or an Annex III category based on its primary function

List your component suppliers

Identify each third-party component with digital elements integrated into your product

Enter your product-level cybersecurity architecture

How components interact, security boundaries, data flows, authentication chains

Document due diligence per component

What cybersecurity evidence you obtained from each supplier, any gaps identified

Map the integrated product against Annex I

Demonstrate that the combined system meets essential cybersecurity requirements end-to-end

Complete vulnerability handling for the integrated product

How you coordinate vulnerability disclosure across your supply chain

Generate the 8-document dossier

Covers both your product-level design and your component integration due diligence

Common mistakes

❌

SUPPLIER PASS-THROUGH

"Each supplier's CE marking covers their component — we just assemble"

Article 13(5) requires the manufacturer of the final product to exercise due diligence when integrating components. A supplier's CE marking on an individual component does not constitute due diligence on your part. You must verify that third-party components do not compromise the cybersecurity of your product as a whole. Your Annex VII dossier must document this verification.

❌

SBOM SCOPE

"Our SBOM only needs to list our own code, not third-party libraries"

Annex VII point 2 requires description of the design, development, and production processes, including component integration. The SBOM should cover all software components in the final product — your code, third-party libraries, open-source dependencies, and firmware from component suppliers. An incomplete SBOM is a documentation gap.

❌

OPEN SOURCE EXEMPTION

"Open-source components are not our responsibility under the CRA"

Article 2 of Regulation (EU) 2024/2847 exempts non-commercial open-source software from manufacturer obligations. However, when you integrate open-source components into a commercial product, you — as the manufacturer of that product — assume responsibility for the cybersecurity of the integrated system. The open-source exemption applies to the upstream developer, not to you as integrator.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Classifies your integrated product based on its primary function. The classification considers the highest-risk component in the stack — if you integrate an Annex III component, it may affect your product's classification.

Technical Documentation

Art. 31 + Annex VII dossier covering the integrated product: system architecture, component inventory, security boundaries, integration validation, due diligence records.

Risk Assessment

Annex I Part I analysis at the integrated product level. Evaluates system-level risks: component interaction vulnerabilities, interface attack surfaces, supply chain risks, cascading failure scenarios.

User Information

Annex II information for the end user: secure setup covering the integrated product's full functionality, component-level configuration where relevant, update procedures.

Declaration of Conformity

Art. 28 + Annex V for the integrated product. References the product's classification and conformity assessment procedure.

CVD Policy

Supply chain-wide vulnerability disclosure: how you receive reports from component suppliers, coordinate patches across the stack, and communicate to downstream users.

Notification Template

Art. 14 ENISA notification. Adapted for vulnerabilities that may originate in a component but affect your integrated product. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Enforcement dates, support period for the integrated product, component supplier support alignment.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 SUPPLY CHAIN COMPLIANCE AUDIT

€20,000–€40,000

10–20 weeks. Requires supplier disclosure and coordination. Must be repeated when the component stack changes. No structured documentation output — audit report format.

✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history