European agricultural companies, surveying firms and public safety agencies are adding CRA compliance clauses to drone procurement RFPs. A drone that cannot demonstrate cybersecurity documentation under Annex VII will not win tenders after 11 December 2027. Most consumer and commercial drones are Default products — not listed in Annex III — eligible for Module A self-assessment. Drones marketed for security surveillance may fall under Annex III point 17 (security cameras) as Class I. CRACheck generates 8 PDF documents per Article 31 and Annex VII. 15-25 minutes. €149 per drone model. Browser-side.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
The EU drone regulation covers the sky. The CRA covers the firmware. Document both.
The EU drone regulation covers the sky. The CRA covers the firmware. Document both.
Regulation (EU) 2019/947 and Delegated Regulation (EU) 2019/945 cover airworthiness, operations and operator obligations. Regulation (EU) 2024/2847 covers cybersecurity. Article 2.5 allows the Commission to limit CRA application where sectoral rules achieve the same level of cybersecurity protection — but no such delegated act has been adopted for drones as of this date. Until it is, both apply.
Annex I Part I point 1(a) of Regulation (EU) 2024/2847 requires protection against unauthorized access. A proprietary radio protocol does not equal security — security through obscurity is not a defense recognised by the CRA. The documentation must describe the authentication and encryption mechanisms of the radio link, not rely on protocol obscurity.
Article 14 of Regulation (EU) 2024/2847 covers actively exploited vulnerabilities and severe incidents impacting product security. If a vulnerability in your drone firmware allows unauthorized takeover, GPS spoofing or data exfiltration, it is a cybersecurity incident under Art. 14. The 24h/72h/14d reporting timeline applies from 11 September 2026.
Drones combine multiple digital systems: radio, video, GPS, cloud, firmware. CRACheck generates 8 documents covering the full cybersecurity surface.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No product data is transmitted to any server.
Generates the Annex VII cybersecurity documentation for your drone. Covers all digital systems: radio, video, GPS, OTA, cloud, companion app.
CRACheck does not assess compliance with EU drone regulations (2019/947, 2019/945), perform flight safety testing or evaluate geofencing compliance. CRA covers cybersecurity. Drone airworthiness is separate.
We document cybersecurity. You handle airworthiness.
Article 64 establishes three tiers of administrative fines. Penalties are calculated per undertaking — but non-compliance on a single product can trigger inspection of your entire portfolio.
Art. 64.2. Up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.
Art. 64.3. Up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Includes failure to produce Annex VII documentation.
Art. 64.4. Up to €5 million or 1% of total worldwide annual turnover, whichever is higher.
Art. 64.5 accounts for the nature, gravity and duration of the infringement, and gives consideration to microenterprises, small and medium-sized enterprises, including start-ups.
| Alternative | Cost | What you get |
|---|---|---|
| European drone + CRA consultancy | €12,000–€25,000 | Combined. 4-8 months. |
| Assume drone regulation covers cybersecurity | €0 | It does not. No delegated act excluding drones from CRA. |
| Document internally | Free + weeks | Complex attack surface. High risk of structural gaps. |
| CRACheck | €149 | 8 CRA docs. 15 min. Covers radio, video, GPS, OTA, app. |
Each drone platform with different firmware, connectivity or digital capabilities needs its own CRA dossier. Volume pricing: €99/product (10-pack), €79/product (30-pack).
Request volume pricingCRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness and truthfulness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct as of the last verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a commercial buyer in a procurement process.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.