A smart speaker with a virtual assistant processes voice commands, manages smart home devices, accesses cloud services and often has an always-listening microphone. The cybersecurity surface is extensive: voice data privacy, authentication of connected devices, cloud API security, OTA firmware updates. Annex III point 16 classifies general-purpose virtual assistants as Class I. If harmonised standards are not fully applied, conformity assessment by a notified body is required under Article 32.2. CRACheck generates 8 PDF documents per Annex VII. 15-25 minutes. €149. Browser-side.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
A virtual assistant listens. CRA requires you to document how you secure what it hears.
A virtual assistant listens. CRA requires you to document how you secure what it hears.
If your smart speaker integrates Alexa or Google Assistant, the platform vendor provides the VA service. But you are the manufacturer of the product with digital elements under Art. 3(13). Your hardware, your firmware, your WiFi module, your microphone, your OTA updates — all are your responsibility. The platform vendor's compliance does not cover your product.
Annex I Part I point 1(c) requires protection of data confidentiality. Even if voice processing happens in the platform vendor's cloud, your product transmits the voice data over WiFi. The security of the transmission — encryption, authentication, channel integrity — is your responsibility. Document it.
Art. 13.8 requires you to declare a support period. If the VA platform is discontinued within your support period, the product loses core functionality. Document the dependency on the platform and what happens to the product if the VA service is discontinued. Annex II requires informing users about the support period.
Smart speakers with virtual assistants combine audio hardware, microphone privacy, cloud processing and smart home control. CRACheck documents all dimensions.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No product data is transmitted to any server.
Generates Annex VII documentation for your smart speaker. Covers microphone, voice processing, cloud integration, device control, WiFi security and OTA updates.
CRACheck does not audit the VA platform (Alexa, Google, proprietary), assess voice data retention policies or test microphone privacy. CRA covers your product's cybersecurity. Platform-level compliance is the platform vendor's responsibility.
We document your product. The platform vendor documents their service.
Article 64 establishes three tiers of administrative fines. Penalties are calculated per undertaking — but non-compliance on a single product can trigger inspection of your entire portfolio.
Art. 64.2. Up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.
Art. 64.3. Up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Includes failure to produce Annex VII documentation.
Art. 64.4. Up to €5 million or 1% of total worldwide annual turnover, whichever is higher.
Art. 64.5 accounts for the nature, gravity and duration of the infringement, and gives consideration to microenterprises, small and medium-sized enterprises, including start-ups.
| Alternative | Cost | What you get |
|---|---|---|
| Smart home certification consultancy | €10,000–€20,000 | Per platform. 3-6 months. |
| Rely on Alexa/Google Works With certification | €0 additional | Works With certification covers interoperability, not CRA cybersecurity. |
| Classify as Default (incorrect for VA) | €0 | Annex III.16 = Class I. Incorrect classification = non-compliance. |
| CRACheck | €149 | 8 docs. 15 min. Class I documentation for smart speaker VA. |
Compact speaker, display speaker, soundbar with VA — each model with different hardware or firmware needs its own dossier. Volume pricing: €99/product (10-pack), €79/product (30-pack).
Request volume pricingCRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness and truthfulness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct as of the last verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a commercial buyer in a procurement process.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.