ETSI EN 303 645 sets out 13 baseline cybersecurity provisions for consumer IoT devices, plus an additional set of data protection provisions. Annex I of Regulation (EU) 2024/2847 sets out 13 product requirements and 8 vulnerability handling obligations for all products with digital elements. There is significant overlap in substance — default passwords, secure updates, minimised attack surfaces — but the CRA adds mandatory documentation under Article 31 (Annex VII technical file), mandatory vulnerability notification under Article 14, and a mandatory EU Declaration of Conformity under Article 28. ETSI EN 303 645 conformity is valuable evidence for the "technical specifications applied" section of the Annex VII file, but it does not produce the file itself. CRACheck generates it.

ETSI EN 303 645 was published in 2020 as the European baseline for consumer IoT security. The UK Product Security and Telecommunications Infrastructure Act 2022 made parts of it mandatory in the UK. In the EU, the CRA supersedes and expands upon ETSI EN 303 645 for products with digital elements. The CRA's Annex I requirements are broader (they cover all products with digital elements, not just consumer IoT), deeper (they require an SBOM, a CVD policy, and ENISA notification), and enforceable (€15M / 2.5% under Article 64). If the European Commission publishes harmonised standards for the CRA that reference ETSI EN 303 645, conformity with the standard could create a presumption of conformity with the overlapping Annex I requirements. But the Annex VII documentation, the Declaration of Conformity, and the Article 14 notification template are CRA-specific and must be produced separately. CRACheck produces them. €149. 15–25 minutes.

€149 one-time payment per product · 8 PDF documents in ZIP · 15–25 minutes · 100% in your browser