CRA vs RED — Difference for Connected Radio Equipment

Key figures

Recital 30

CRA includes all RED Art. 3(3)(d)(e)(f) cybersecurity elements

Art. 2(5)

CRA may limit/exclude application where sectoral rules achieve same protection level

€15M

Maximum CRA fine under Art. 64(2)

How CRACheck handles the CRA documentation for radio equipment

If your product is radio equipment under Directive 2014/53/EU and also a product with digital elements under Regulation (EU) 2024/2847, you need RED conformity for radio/EMC/safety AND CRA documentation for cybersecurity. CRACheck covers the CRA layer.

Product identification

You enter the product type, radio technology (Wi-Fi, Bluetooth, cellular, LoRa, Zigbee, etc.), network connectivity, and intended purpose. CRACheck scopes both the CRA classification (Annex III includes routers, modems, and switches in Class I category 12) and the CRA cybersecurity requirements.

Classification

Many radio equipment products fall into Annex III Class I category 12 (routers, modems intended for internet connection, switches) or category 10 (physical and virtual network interfaces). CRACheck cross-references and documents the classification.

Annex I mapping

CRACheck maps the 21 Annex I requirements to your product. For radio equipment, requirements like secure-by-default configuration (2)(b), vulnerability patching (2)(c), access control (2)(d), encryption (2)(e), and attack surface reduction (2)(j) are typically all applicable.

Vulnerability handling

CRACheck documents your SBOM, CVD policy, and update distribution mechanism. For radio equipment, over-the-air update security is a critical element under Annex I Part II point (7).

Documentation output

8 PDFs covering the CRA cybersecurity layer. Your RED technical file (radio tests, EMC measurements, safety assessments) remains a separate documentation set.

Common mistakes

❌

RECITAL 30

Assuming the RED cybersecurity requirements are sufficient and the CRA adds nothing

Recital 30 of the CRA states that the CRA includes all elements of RED Article 3(3)(d)(e)(f). But the CRA adds significantly more: Article 31 technical documentation (Annex VII), Article 14 vulnerability notification to ENISA, Article 13 manufacturer obligations including risk assessment, and Annex I Part II vulnerability handling requirements. RED does not require an SBOM, a CVD policy, or ENISA notifications.

❌

ANNEX III · CAT 12

Treating a Wi-Fi router as a Default product

Annex III Class I category 12 lists "routers, modems intended for the connection to the internet, and switches." If your radio equipment is a router or internet-connected modem, it is Important Class I, not Default. The classification determines whether Module A self-assessment is available (only if harmonised standards are applied in full under Article 32(2)).

❌

ART. 13(4)

Creating separate technical documentation for CRA and RED without cross-referencing

Article 13(4) of the CRA states that for products subject to other Union legal acts requiring technical documentation, "the cybersecurity risk assessment may be part of the risk assessment required by those Union legal acts." Article 31(3) allows a single technical documentation set. The two files can coexist in one document, reducing duplication.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Classification under CRA Annex III (many radio equipment products fall under Class I category 10 or 12). Documents the dual RED + CRA applicability.

Technical Documentation

CRA Annex VII file. Can reference the existing RED technical file for shared elements. Adds cybersecurity-specific content: system architecture, SBOM, CVD policy, vulnerability handling.

Risk Assessment

CRA cybersecurity risk assessment per Article 13(2)–(3). Complementary to — not a replacement for — any RED-specific risk analysis.

User Information

Annex II sheet. Includes support period, vulnerability reporting contact, and security instructions for firmware updates.

Declaration of Conformity

CRA Declaration per Article 28 + Annex V. Article 28(3) allows combining CRA and RED declarations in a single document, but both regulations must be cited.

CVD Policy

Required by Annex I Part II point (5). Not required by the RED.

Notification Template

ENISA notification per Article 14. Not required by the RED.

Obligations Calendar

CRA dates (11 Sept 2026 for Article 14, 11 Dec 2027 for full enforcement) alongside RED timeline.

See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 THE ALTERNATIVE

Add CRA scope to existing RED compliance consultancy

€8,000–20,000 on top of RED engagement

3–6 months additional work

The consultant must understand both frameworks

✓ CRACHECK

€149 per product for the CRA documentation layer

Your RED compliance is already handled by your existing process

CRACheck adds the cybersecurity documentation that the RED does not produce: SBOM, CVD policy, Annex VII file, ENISA notification template

15–25 minutes

30-day edit window. 10 regenerations

Two layers

● LAYER 1 — DOCUMENTATION · CRACHECK

CRA cybersecurity documentation for radio equipment

CRACheck generates the CRA cybersecurity documentation: Annex VII technical file, Annex I risk assessment, Declaration of Conformity (CRA-specific), CVD policy, ENISA notification template, and obligations calendar. This is the documentation layer that the CRA adds beyond the RED.

∅ LAYER 2 — NOT INCLUDED

What CRACheck does not do

CRACheck does not generate RED documentation. It does not produce radio test reports, EMC measurements, safety assessments, or the RED Declaration of Conformity citing Directive 2014/53/EU. RED compliance requires your existing testing laboratories and notified bodies.

RED covers radio. CRA covers cybersecurity. CRACheck covers the CRA layer.

Enforcement regime

⚖️

CRA: €15M / 2.5% — Art. 64(2)

Annex I cybersecurity non-compliance.

⚖️

CRA: €10M / 2% — Art. 64(3)

Missing Art. 31 technical documentation or Art. 32 conformity assessment.

⚖️

RED: National penalties under Directive 2014/53/EU

Vary by Member State, typically €50,000–€500,000 + product withdrawal. CRA and RED penalties are independent.

Alternatives

Criterio	RED (Dir. 2014/53/EU)	CRA (Reg. 2024/2847)	CRACheck scope
Focus	Radio spectrum, EMC, safety	Cybersecurity	Cybersecurity documentation
Cybersecurity	Art. 3(3)(d)(e)(f) via Del. Reg. 2022/30	Annex I (21 requirements)	Maps all 21 requirements
Tech doc	RED technical file	Art. 31 + Annex VII	Generates Annex VII
Vulnerability reporting	Not required	Art. 14 (24h/72h/14d to ENISA)	Notification template
SBOM	Not required	Annex I Part II + Annex VII	Documented in tech file
CVD policy	Not required	Annex I Part II point (5)	Generated as PDF
CRACheck	CRA layer	Annex VII	Art. 14	SBOM	CVD

Product line of radio equipment with multiple SKUs?

Each radio product variant needs its own CRA documentation. Volume pricing: Pack of 10: €99. Pack of 30: €79.

Request volume pricing

Commercial enquiries via hello@solidwaretools.com

What CRACheck guarantees and what it does not

CRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847, based on the information you enter. The accuracy, completeness, and truthfulness of that information is your responsibility as manufacturer.

We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case.

CRACheck is not legal advice. For situations specific to your product or market, consult a qualified lawyer or specialised regulatory consultancy.

Frequently asked questions

Does the CRA replace the RED cybersecurity requirements under Delegated Regulation (EU) 2022/30?

Not formally. Recital 30 of Regulation (EU) 2024/2847 states that the CRA's essential cybersecurity requirements "include all the elements" of RED Article 3(3)(d)(e)(f). Article 2(5) of the CRA empowers the Commission to adopt delegated acts limiting or excluding CRA application where sectoral rules achieve the same protection level. Until such a delegated act is adopted, both frameworks coexist. In practice, CRA compliance on cybersecurity will cover — and exceed — the RED cybersecurity requirements.

My product is a Wi-Fi router. Is it Default or Important under the CRA?

Annex III Class I category 12 of Regulation (EU) 2024/2847 lists "routers, modems intended for the connection to the internet, and switches." If your Wi-Fi router is intended for internet connection, it is Important Class I. This means Module A self-assessment is available only if harmonised standards are applied in full (Article 32(2)). Otherwise, Module B+C or Module H with a notified body is required.

Can I combine the CRA and RED technical documentation into one file?

Yes. Article 31(3) of Regulation (EU) 2024/2847 states that for products subject to other Union legal acts requiring technical documentation, "a single set of technical documentation shall be drawn up containing the information referred to in Annex VII and the information required by those Union legal acts." You can integrate the CRA Annex VII content into your existing RED technical file.

Can I combine the CRA and RED Declarations of Conformity?

Yes. Article 28(3) of the CRA allows a single EU Declaration of Conformity covering multiple Union legal acts. The combined Declaration must cite both Regulation (EU) 2024/2847 and Directive 2014/53/EU with their publication references.

Is this a subscription?

No. One-time payment. The licence includes 30 days of editing and 10 regenerations. The downloaded PDF is yours permanently.

Can I request a refund?

Under Art. 16(m) of Directive (EU) 2011/83, activating the licence constitutes express consent for immediate generation of digital content, waiving the 14-day withdrawal right. Refunds are only processed for reproducible technical failures.

What if the regulation changes?

If Regulation (EU) 2024/2847 is amended during your licence window, you can regenerate the documentation using the updated version of the generator at no additional cost.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act — full text
Directive 2014/53/EU — Radio Equipment Directive — full text

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.