Many Chinese IoT manufacturers have OTA capability but have never documented it for regulatory purposes. The CRA changes this. Annex I Part II establishes detailed requirements: provide updates without delay (point 8), ensure the update mechanism is secure against manipulation, separate security updates from functionality updates where possible (point 8), and communicate updates to users (Annex II). Annex VII point 2(b) requires the documentation to describe the secure distribution of updates. CRACheck generates 8 PDF documents that include your OTA architecture documentation. 15-25 minutes. €149. Browser-side.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
Document what you have. Fix what you need to fix. CRACheck handles the documentation.
Document what you have. Fix what you need to fix. CRACheck handles the documentation.
Annex I Part II point 8 requires that, where technically feasible, security updates are provided through automatic mechanisms with user opt-out. A manual download from a website is not an automatic mechanism. If your product has network connectivity (WiFi, LTE, Ethernet), automatic OTA is technically feasible. Document your automatic update capability.
Annex VII point 2(b) explicitly requires description of "the technical solutions chosen for the secure distribution of updates." Having OTA capability is not enough. The documentation must describe: how updates are signed, how the device verifies authenticity, how the update channel is secured, how rollback is handled. The how, not just the that.
Annex I Part I point 1(a) requires protection against unauthorized access. Firmware distributed over unencrypted HTTP can be intercepted and modified in transit (man-in-the-middle). The update mechanism must ensure integrity and authenticity of the update package. HTTPS, signed firmware images and certificate pinning are standard approaches.
The OTA architecture is documented across multiple CRA documents. CRACheck generates 8 PDFs with consistent OTA documentation throughout.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No product data is transmitted to any server.