Many Chinese IoT manufacturers have OTA capability but have never documented it for regulatory purposes. The CRA changes this. Annex I Part II establishes detailed requirements: provide updates without delay (point 8), ensure the update mechanism is secure against manipulation, separate security updates from functionality updates where possible (point 8), and communicate updates to users (Annex II). Annex VII point 2(b) requires the documentation to describe the secure distribution of updates. CRACheck generates 8 PDF documents that include your OTA architecture documentation. 15-25 minutes. €149. Browser-side.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
Document what you have. Fix what you need to fix. CRACheck handles the documentation.
Document what you have. Fix what you need to fix. CRACheck handles the documentation.
Annex I Part II point 8 requires that, where technically feasible, security updates are provided through automatic mechanisms with user opt-out. A manual download from a website is not an automatic mechanism. If your product has network connectivity (WiFi, LTE, Ethernet), automatic OTA is technically feasible. Document your automatic update capability.
Annex VII point 2(b) explicitly requires description of "the technical solutions chosen for the secure distribution of updates." Having OTA capability is not enough. The documentation must describe: how updates are signed, how the device verifies authenticity, how the update channel is secured, how rollback is handled. The how, not just the that.
Annex I Part I point 1(a) requires protection against unauthorized access. Firmware distributed over unencrypted HTTP can be intercepted and modified in transit (man-in-the-middle). The update mechanism must ensure integrity and authenticity of the update package. HTTPS, signed firmware images and certificate pinning are standard approaches.
The OTA architecture is documented across multiple CRA documents. CRACheck generates 8 PDFs with consistent OTA documentation throughout.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No product data is transmitted to any server.
Documents your OTA architecture within the Annex VII Technical Documentation. Covers signing, distribution, verification, rollback and automatic update capability.
CRACheck does not audit your OTA implementation, test firmware signing or verify update channel encryption. If your OTA has security gaps, the documentation will not hide them. Fix the implementation, then document it.
We document the architecture. You secure the implementation.
Article 64 establishes three tiers of administrative fines. Penalties are calculated per undertaking — but non-compliance on a single product can trigger inspection of your entire portfolio.
Art. 64.2. Up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.
Art. 64.3. Up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Includes failure to produce Annex VII documentation.
Art. 64.4. Up to €5 million or 1% of total worldwide annual turnover, whichever is higher.
Art. 64.5 accounts for the nature, gravity and duration of the infringement, and gives consideration to microenterprises, small and medium-sized enterprises, including start-ups.
| Alternative | Cost | What you get |
|---|---|---|
| OTA security audit + documentation | €10,000–€25,000 | Audit + docs. 2-4 months. |
| Document "OTA available" without details | €0 | Insufficient. Annex VII.2(b) requires technical detail. |
| No OTA capability | €0 | Non-compliant with Annex I.II.8 if automatic updates are technically feasible. |
| CRACheck | €149 | 8 docs with detailed OTA documentation. 15 min. |
If products share the same OTA infrastructure, the OTA documentation sections overlap. Each product still needs its own Annex VII dossier. Volume pricing: €99/product (10-pack), €79/product (30-pack).
Request volume pricingCRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness and truthfulness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct as of the last verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a commercial buyer in a procurement process.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.