ETSI EN 303 645 was published in 2020 as the European baseline for consumer IoT security. The UK Product Security and Telecommunications Infrastructure Act 2022 made parts of it mandatory in the UK. In the EU, the CRA supersedes and expands upon ETSI EN 303 645 for products with digital elements. The CRA's Annex I requirements are broader (they cover all products with digital elements, not just consumer IoT), deeper (they require an SBOM, a CVD policy, and ENISA notification), and enforceable (€15M / 2.5% under Article 64). If the European Commission publishes harmonised standards for the CRA that reference ETSI EN 303 645, conformity with the standard could create a presumption of conformity with the overlapping Annex I requirements. But the Annex VII documentation, the Declaration of Conformity, and the Article 14 notification template are CRA-specific and must be produced separately. CRACheck produces them. €149. 15–25 minutes.
€149 one-time payment per product · 8 PDF documents in ZIP · 15–25 minutes · 100% in your browser
ETSI EN 303 645 conformity strengthens your Annex VII file. It does not replace it.
ETSI EN 303 645 is a voluntary standard with 13 baseline provisions for consumer IoT. The CRA is a mandatory EU regulation with 21 requirements, mandatory documentation, and enforceable penalties. Conformity with the standard is supporting evidence, not compliance with the regulation.
The CRA requires: SBOM in machine-readable format (Part II point 1), coordinated vulnerability disclosure policy (Part II point 5), ENISA notification within 24 hours (Article 14), and free security updates throughout the support period (Part II point 8). ETSI EN 303 645 Provisions 5.2 and 5.3 partially address vulnerability disclosure and software updates, but not at the specificity or enforcement level of the CRA.
The UK PSTI Act references ETSI EN 303 645 for certain requirements. The EU CRA is a separate regulation with its own documentation requirements. UK market compliance does not produce EU CRA documentation. If you sell in both markets, you need both compliance sets.
CRACheck generates CRA documentation, referencing ETSI EN 303 645 where applicable. Covers all CRA-specific requirements.
Annex III / Annex IV classification. Conformity assessment module.
Art. 31 + Annex VII. Complete dossier.
Art. 13(2)–(3). Cybersecurity risk assessment against Annex I.
Annex II. 9 required information points.
Art. 28 + Annex V. Ready for signature.
Annex I Part II point (5). Coordinated vulnerability disclosure.
Art. 14. ENISA 24h/72h/14d notification.
Key dates and milestones.
See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.
Generated in your browser. No data leaves your device.
CRACheck generates CRA documentation, referencing ETSI EN 303 645 where applicable. Covers all CRA-specific requirements: Annex VII file, cybersecurity risk assessment, Declaration of Conformity, CVD policy, ENISA notification template, user information, obligations calendar.
CRACheck does not perform ETSI EN 303 645 testing or assessment. It does not issue ETSI conformity statements. ETSI testing is performed by accredited test laboratories. CRACheck references the results in the CRA documentation.
ETSI EN 303 645 is evidence. The CRA file is the obligation. CRACheck generates the obligation.
Art. 64(2) of Regulation (EU) 2024/2847.
Art. 64(3) of Regulation (EU) 2024/2847.
Art. 64(4) of Regulation (EU) 2024/2847.
ETSI EN 303 645 has no penalty mechanism — the CRA does.
| Criterion | ETSI EN 303 645 | CRA (Reg. 2024/2847) | CRACheck scope |
|---|---|---|---|
| Nature | Voluntary European standard | Mandatory EU Regulation | Mandatory documentation |
| Scope | Consumer IoT devices | All products w/ digital elements | Per product |
| Requirements | 13 baseline provisions | 21 requirements (13+8) | Maps all 21 |
| Documentation | Test report / conformity statement | Art. 31 + Annex VII file | Generates Annex VII |
| Penalties | None | €15M / 2.5% (Art. 64) | Documentation to reduce risk |
| SBOM | Not required | Annex I Part II point (1) | Documented |
Each IoT device variant needs its own CRA file. Volume pricing: Pack of 10: €99. Pack of 30: €79.
Request Volume PricingCRACheck generates a structured document set according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness, and truthfulness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct. We do not guarantee that a specific document will be accepted by a market surveillance authority in a particular case.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.