Do European universities require CRA documentation from vendors?

Public universities in the EU follow procurement regulations that require compliance with applicable EU legislation. As the CRA becomes enforceable, universities will include Regulation (EU) 2024/2847 compliance in tender specifications. Some are already requesting CRA readiness documentation in vendor assessments.

Our proctoring tool uses webcam and screen recording. Does that affect CRA classification?

The proctoring tool's biometric and surveillance capabilities do not change CRA classification per se — classification under Annex III is based on cybersecurity function, not data type. However, the risk assessment must address the sensitivity of the data: webcam feeds, screen recordings, and keystroke logs require strong confidentiality and integrity controls per Annex I.

We distribute our LTI plugin through a university's LMS. Who places it on the market?

If you develop the plugin and make it available for universities to install in their LMS, you are placing a software component on the market. You are the manufacturer under Article 3(13). The university installs your product but did not manufacture it.

Student data is covered by GDPR. Does CRA add anything?

CRA adds product-level cybersecurity documentation requirements: technical documentation (Art. 31), risk assessment (Art. 13), and conformity declaration (Art. 28). These are product obligations distinct from GDPR data processing obligations. Both apply.

Can we use CRACheck documentation in multiple university tenders?

Yes. One Article 31 dossier per product is valid across all EU institutions. Include it as a standard appendix in every tender response.

Is CRACheck a subscription?

No. One-time payment. 30 days of editing, 10 regenerations. The PDF is yours to keep.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, activating the license constitutes express consent for immediate generation. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate at no additional cost during your license period.

Your e-learning platform serves European universities, schools, and corporate training departments. The student mobile app, the proctoring desktop application, and the LTI plugin are products with digital elements under Article 3(1) of Regulation (EU) 2024/2847. European educational institutions — particularly public universities subject to procurement regulation — are adding CRA to their vendor requirements. CRACheck generates the documentation before the next academic procurement cycle.

Educational technology platforms handle student data, assessment records, and academic credentials. When these platforms distribute downloadable components — mobile apps for students, desktop proctoring tools, LTI plugins for LMS integration — they become products with digital elements under the CRA. Article 13 of Regulation (EU) 2024/2847 requires the manufacturer to produce technical documentation, conduct a cybersecurity risk assessment, and declare conformity. European universities operating under public procurement rules will formalize CRA requirements in tender specifications. CRACheck generates the 8-document dossier in 15-25 minutes for €149.

Generate CRA documentation — €149 Free: check your product classification

€149 one-time · 8-document ZIP · 15–25 minutes · Browser-side

Key numbers

Art. 3(1)

Student app + proctoring tool + LTI plugin = products with digital elements

Annex I

Data confidentiality for student records + system availability for exam delivery = essential requirements

€149

Full CRA dossier per product

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Define your edtech product

LMS platform, student mobile app, proctoring tool, LTI plugin. CRACheck documents all components.

Classify under Annex III

E-learning platforms typically classify as Default. Proctoring tools with biometric functions may require careful classification.

Describe student data handling

Academic records, assessment scores, video proctoring data, personal identifiers, and communication logs.

Map security architecture

Authentication for students and instructors, exam integrity mechanisms, video stream encryption, and LTI secure launch protocols.

Generate risk assessment

Edtech threats: exam cheating through platform manipulation, student data breach, unauthorized grade modification, proctoring video exposure, and LTI integration vulnerabilities.

Produce 8 documents

Technical documentation, risk assessment, declaration of conformity, user information, CVD policy, ENISA template, obligations calendar.

Submit to procurement

Documentation accompanies your tender response or vendor registration for EU educational institutions.

Common mistakes

❌

NO PUBLIC INTEREST EXEMPTION

"Educational platforms are exempt because they serve a public interest"

The CRA does not exempt products based on the sector they serve. Article 2(1) covers all products with digital elements placed on the EU market. Educational purpose does not create an exemption. If your platform has downloadable components available to EU users, CRA applies.

❌

TEMPORARY ≠ EXEMPT

"Our proctoring tool only runs during exams — it is not a permanent installation"

A proctoring application installed on a student's device, even temporarily, is software placed on the EU market. CRA scope does not require permanent installation. The product is placed on the market when made available for download or installation, regardless of usage duration.

❌

MANUFACTURER vs USER

"Universities handle their own IT compliance — they will manage CRA"

The university is the user of your product, not the manufacturer. Article 13 obligations rest with the entity that designed and developed the product — you. The university may have institutional IT compliance obligations, but these do not replace your manufacturer obligations under CRA.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Annex III classification for e-learning software.

Technical Documentation

Art. 31 + Annex VII covering LMS, mobile app, proctoring tool, and LTI integration.

Risk Assessment

Edtech-specific: student data breach, exam integrity compromise, proctoring video exposure, platform availability during exam periods.

User Information

Annex II for institutional admins and students: app permissions, data handling, proctoring data retention, security properties.

Declaration of Conformity

Art. 28 + Annex V.

CVD Policy

Vulnerability disclosure policy for educational software.

Notification Template

ENISA template per Article 14 for edtech incidents. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

CRA milestones aligned with academic procurement cycles.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 EDTECH REGULATORY CONSULTANT

€10,000–€20,000

6-12 weeks. May miss the academic procurement window.

✓ Last regulatory check: 1 May 2026 · No substantive changes detected · View history