CRA China OEM ODM White Label CE Marking

Key numbers

Art. 3(13)

Defines manufacturer. The EU brand is the manufacturer — but needs your documentation.

Art. 13.5

Due diligence on third-party components. The brand must verify your components do not compromise cybersecurity.

€149

Per product model. Generate the documentation your EU brand customer contractually requires.

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Understand the legal structure

The EU brand is the manufacturer under Art. 3(13). You are the development and production partner. The brand is legally responsible. But they will require your documentation because you have the engineering data.

Anticipate contract clauses

EU brands are adding CRA clauses to OEM agreements: "Supplier shall deliver technical documentation per Annex VII." Prepare before you receive the clause.

Generate documentation per product model

Enter your product's engineering data into CRACheck. 15-25 minutes.

Deliver to your EU brand customer

Send the 8-document ZIP. The brand integrates it into their CE dossier and assumes manufacturer responsibility.

Maintain and update

When you release a firmware update, regenerate the documentation. Art. 31.2 requires continuous updates during the support period. 10 regenerations per licence.

Common mistakes

❌

ART. 3(13)

"We are the OEM — we are the manufacturer under CRA"

Not necessarily. Article 3(13) defines the manufacturer as the entity that places the product on the market under their name or trademark. If the EU brand puts their logo on your product and sells it, they are the manufacturer. If you sell under your own brand directly to EU distributors, you are the manufacturer.

❌

ART. 22

"If the EU brand modifies our firmware, they become the manufacturer"

Article 22 states that a person who carries out a substantial modification and makes the product available is considered a manufacturer. Minor firmware customisation (language packs, UI branding) is not a substantial modification. If the EU brand changes the security architecture — that may constitute a substantial modification.

❌

ART. 13.5

"The EU brand never asks about our components — they just put their label on it"

Article 13.5 requires manufacturers to exercise due diligence when integrating third-party components. The EU brand, as manufacturer, must verify that your components do not compromise cybersecurity. They will ask about your WiFi module vendor, your RTOS, your cryptographic libraries.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Classifies the product per Annex III. Helps the EU brand determine the conformity assessment route.

Technical Documentation

Art. 31 + Annex VII. Contains the design, development and vulnerability handling information only your factory possesses.

Risk Assessment

Art. 13.2-13.3. Maps the cybersecurity risks assessed during development.

User Information

Annex II. Technical cybersecurity instructions the EU brand will include with the retail packaging.

Declaration of Conformity

Art. 28 + Annex V. Draft declaration the EU brand adapts and signs as manufacturer.

CVD Policy

Vulnerability disclosure policy. The EU brand may publish this or create their own referencing your process.

Notification Template

Art. 14. Pre-structured for the manufacturer (EU brand) to use. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Key CRA dates for the product lifecycle.

See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 EUROPEAN CONSULTANT TO DOCUMENT YOUR OEM PRODUCTS

€8,000–€20,000

Per product family. Requires NDA, IP disclosure, multiple meetings.

✓ CRACHECK

€149

8 documents. 15 min. You control the data. No IP disclosure to third parties. Pack 10: €99/product.

Two layers

● LAYER 1

What CRACheck does

Generates the Annex VII documentation your EU brand customer contractually requires. You fill in your engineering data. They receive structured documentation.

∅ LAYER 2

What CRACheck does NOT do

CRACheck does not define who is the manufacturer under Art. 3(13). It does not draft OEM contractual clauses or allocate liability between factory and brand. For contractual structures, consult a lawyer.

We generate documentation. You and your EU brand define who signs it.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Non-compliance with Annex I + Art. 13/14 (Art. 64(2))

€15,000,000 / 2.5%

Art. 64.2.

🟠

Non-compliance with Art. 31, Art. 28, Art. 32 (Art. 64(3))

€10,000,000 / 2%

Art. 64.3.

🟡

Incorrect or misleading information (Art. 64(4))

€5,000,000 / 1%

Art. 64.4.

Alternatives

Criterion	European regulatory consultant	Let the EU brand handle it	Send product datasheets as documentation	CRACheck
Cost	€8,000–€20,000	€0 for you	€0	€149
Result	Per product family. Requires IP disclosure.	The brand will ask you for engineering data anyway. Delays the order.	Datasheets do not satisfy Annex VII. Risk of contract rejection.	8 docs. 15 min. Deliver documentation with the product samples.

Your factory produces dozens of product models for EU brands?

Each product model needs its own Annex VII dossier. If you make smart plugs, cameras and sensors for three different EU brands, that is 9+ dossiers. Volume pricing: €99/product (10-pack), €79/product (30-pack).

Request Volume Pricing

Response within one business day.

What CRACheck guarantees and what it does not

CRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness and truthfulness of that information is your responsibility as the manufacturer.

We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a commercial buyer in a procurement process.

CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions

Who signs the Declaration of Conformity — the factory or the EU brand?

Under Article 28, the manufacturer signs the EU declaration of conformity. If the EU brand is the manufacturer under Art. 3(13), they sign. CRACheck generates a draft declaration that the manufacturer adapts and signs.

Can we generate one dossier for all brand customers using the same product?

If the product is technically identical — same hardware, same firmware, same cybersecurity properties — the Annex VII documentation covers the product itself. Different brand customers can reference the same technical documentation. However, each brand customer will need their own Declaration of Conformity as they are separate manufacturers.

What if our EU brand customer modifies the firmware?

If the modification changes the cybersecurity properties, the documentation may need updating. Article 22 addresses substantial modifications. The documentation should reflect the product as placed on the market.

Can we offer CRACheck documentation as a paid add-on to EU brands?

CRACheck is licensed per product, not per end user. You can generate the documentation and deliver it to your EU brand customer as part of your OEM package. The licence covers generation of the documents.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Pursuant to Art. 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate at no additional cost during licence validity.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act — full text

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.