CRA & CE Marking for Turkish Electronics Exporters

Key numbers

Art. 30

CE marking must reflect CRA conformity from Dec 2027

Annex I

New essential cybersecurity requirements for CE

€149

Per product, one-time documentation

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Classify your product

CRACheck checks your product against Annex III and Annex IV to determine Default, Important, or Critical classification

Enter your product profile

Product type, connectivity, firmware, data processing, user-facing features

Map your product against Annex I essential cybersecurity requirements

These are the new CE requirements specific to the CRA

Document your vulnerability handling processes

Art. 14 readiness: early warning, notification, final report to ENISA

Define your support commitment

Security update period aligned with product lifecycle (minimum 5 years per Art. 13(8))

Generate the 8-document CRA dossier

Your new CE documentation layer, separate from but complementary to your existing technical files

Integrate into your CE marking process

The CRA Declaration of Conformity references Art. 28 + Annex V alongside your existing Declarations

Common mistakes

❌

CE CONTINUITY MYTH

"Our current CE marking process will continue to work after 2027"

CE marking after 11 December 2027 must reflect compliance with Regulation (EU) 2024/2847 for any product with digital elements. Article 30(1) requires the CE marking to be affixed only after conformity with the CRA has been demonstrated. Your existing CE marking under LVD, EMC, or RED remains necessary — but it is no longer sufficient. The CRA adds a new legal basis to your CE Declaration.

❌

DOCUMENTATION OVERLAP

"We can add CRA information to our existing technical file — no separate document needed"

Article 31 and Annex VII define a specific documentation structure for the CRA. While you may physically include it in the same technical file binder, the CRA documentation has distinct content requirements: cybersecurity risk assessment (Annex I Part I), vulnerability handling processes (Annex I Part II), SBOM, user information (Annex II), and conformity assessment evidence (Annex VIII). These sections do not exist in your LVD or EMC files.

❌

TIMELINE MISCALCULATION

"December 2027 is far away — we have time"

Article 14 reporting obligations for actively exploited vulnerabilities apply from 11 September 2026 — more than a year before full enforcement. By September 2026, you must have a vulnerability handling process in place and be ready to notify ENISA within 24 hours. The documentation supporting this process should be prepared now, not in November 2027.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Confirms your product's classification: Default (90%+ of products), Important Class I or II (Annex III), or Critical (Annex IV). Determines which conformity assessment module applies under Article 32.

Technical Documentation

Art. 31 + Annex VII dossier. This is the new layer your CE technical file is missing: cybersecurity design, development, production, and vulnerability handling documentation.

Risk Assessment

Annex I Part I cybersecurity risk analysis. Your existing CE risk assessments cover electrical safety and EMC — this one covers cybersecurity threats specific to connected products.

User Information

Annex II information package. New consumer-facing cybersecurity information: secure setup, password management, update procedures, data handling, support period disclosure.

Declaration of Conformity

Art. 28 + Annex V. A new Declaration citing Regulation (EU) 2024/2847 as legal basis, alongside your existing Declarations for other applicable directives.

CVD Policy

Coordinated vulnerability disclosure: how end users and researchers report security issues. This is a CRA-specific requirement not covered by existing CE directives.

Notification Template

Art. 14 ENISA notification for actively exploited vulnerabilities. Your entry point for the mandatory reporting obligation active from September 2026.

Obligations Calendar

Two-phase timeline: Art. 14 reporting from 11 September 2026, full enforcement 11 December 2027, plus your product-specific support period.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 EXPAND YOUR CURRENT CE CONSULTANCY TO COVER CRA

€10,000–€25,000

8–14 weeks. Your CE consultant may not have CRA expertise — new regulation, new learning curve. Requires renegotiating scope and fees. No structured CRA-specific output.

✓ CRACHECK

€149

8 documents. 15–25 min. Designed specifically for Regulation (EU) 2024/2847. Browser-side. 8 PDFs structured per Annex VII — drops into your CE file as the CRA layer. Pack 10: €99/product. Pack 30: €79/product.

Two layers

● LAYER 1

The CRA layer for your CE file

CRACheck generates the documentation that the CRA adds to your CE marking requirements: Annex VII technical file, Annex I compliance mapping, Art. 28 Declaration, vulnerability handling documentation. This layer did not exist in your CE process before. It is the missing piece for post-2027 market access.

∅ LAYER 2

Cybersecurity implementation

CRACheck does not implement the security features your product needs to comply with Annex I. If your connected product lacks encryption, secure updates, authentication, or data minimisation, engineering work is needed before the documentation can be accurate. CRACheck documents the security you have built — it does not build the security.

If your products already have strong cybersecurity features, Layer 1 is a documentation exercise. If they do not, start engineering now and document when the features are implemented. Either way, the December 2027 deadline is fixed.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Essential requirements + manufacturer obligations (Art. 64(2))

€15,000,000 / 2.5%

Annex I + Art. 13/14.

🟠

Documentation and CE marking obligations (Art. 64(3))

€10,000,000 / 2%

Art. 28, 30, 31, 32.

🟡

Misleading information (Art. 64(4))

€5,000,000 / 1%

Misleading information.

Alternatives

Criterion	Extend Current CE Consultant	New CRA-Specific Consultant	Internal Compliance Team	CRACheck
Time per product	8–14 weeks	6–10 weeks	4–10 weeks	15–25 minutes
Cost	€10,000–€25,000	€8,000–€18,000	Staff + training	€149
CRA expertise	May require upskilling	Variable	New regulation learning	Purpose-built for CRA
Output format	Varies — added to CE report	Consultant PDF	Internal templates	8 standardised PDFs per Annex VII

Full product catalogue needs CRA documentation?

Turkish electronics exporters often have dozens of connected products in their EU catalogue. Each product with distinct firmware and connectivity requires its own CRA dossier. Volume pricing: €99/product (pack 10), €79/product (pack 30).

Request Volume Pricing

Products with identical firmware, connectivity, and security architecture may share a single dossier.

What CRACheck guarantees and what it does not

CRACheck generates a structured document aligned with Article 31 and Annex VII of Regulation (EU) 2024/2847 based on your product data. The accuracy of the information you enter is your responsibility as manufacturer.

We guarantee the document structure follows Art. 31 + Annex VII and that legal references, including the CE marking provisions of Article 30, are correct. We do not guarantee acceptance by an EU market surveillance authority in a specific case.

CRACheck is not legal advice. For questions about CE marking obligations under the CRA, the customs union framework, or the need for an authorised representative under Article 18, consult a regulatory attorney.

Frequently asked questions

Will CE marking under the CRA look different on the product?

No. The CE marking itself is the same symbol (Article 30). What changes is the legal basis: after 11 December 2027, your Declaration of Conformity must cite Regulation (EU) 2024/2847 alongside the other applicable directives. Market surveillance authorities will verify that the CRA Declaration exists and that technical documentation supports it.

Can we issue a single combined Declaration of Conformity?

You may issue a combined Declaration covering multiple EU legal acts, or separate Declarations per regulation. Article 28(2) of the CRA states the Declaration shall contain all required elements of Annex V. CRACheck generates the CRA-specific Declaration, which you can include in a combined document or present separately.

Is the Art. 14 vulnerability reporting obligation really active from September 2026?

Yes. Article 14 reporting obligations apply from 11 September 2026, over a year before full enforcement. From that date, if you become aware of an actively exploited vulnerability in any product you have placed on the EU market, you must notify ENISA within 24 hours (early warning), 72 hours (notification), and 14 days (final report). CRACheck provides the notification template structure.

Do all our products need CRA documentation, or only "smart" ones?

The CRA applies to products with digital elements — defined in Article 3(1) as software or hardware products with a direct or indirect logical or physical data connection to a device or network. If a product has firmware, processes data, or connects to a network in any way, it is within scope. Purely analogue electronics without any digital element are not covered.

Can our Turkish test laboratory perform CRA conformity assessment?

For Default products using Module A (self-assessment), no laboratory or notified body is needed — the manufacturer performs internal control per Annex VIII Part I. For Important products requiring third-party assessment, only notified bodies designated by EU Member States under Articles 35–40 can perform the assessment. Turkish laboratories would need to be notified under this framework.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Under Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation is amended?

Regenerate at no additional cost during licence validity.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.