Your EU Customer's CISO Asked About CRA

Key numbers

48h

Typical response window before an EU CISO escalates a vendor compliance gap to procurement

8 documents

The complete CRA dossier that answers every question the CISO will ask

€149

Cost to produce the documentation that keeps your European contract alive

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Receive the CISO inquiry

The email asks about Regulation (EU) 2024/2847. Your product is a product with digital elements under Article 3(1). You need documentation.

Open CRACheck

Enter your product details: name, version, architecture, security controls, deployment model. All processing stays in your browser.

Classify your product

CRACheck determines your Annex III category and conformity assessment path. This is the first data point the CISO needs.

Generate risk assessment

Structured cybersecurity analysis per Article 13(2)-(3). Demonstrates you have evaluated threats specific to your product.

Produce the full dossier

8 PDFs: technical documentation, risk assessment, declaration of conformity, user information, CVD policy, ENISA notification template, obligations calendar, product classifier.

Respond to the CISO

Attach the relevant documents to your reply. The CISO sees structured, regulation-referenced documentation — not a vague promise.

Retain the contract

Your competitor who responded with "we are evaluating our CRA obligations" gets flagged. You move forward.

Common mistakes

❌

COMMERCIAL MISJUDGMENT

"We responded that CRA does not apply until 2027, so compliance is not required yet"

The CISO is not asking about enforcement dates. They are assessing vendor risk for their organization's supply chain. European CISOs under DORA or NIS2 must evaluate ICT third-party risk continuously. A response citing future enforcement dates tells the CISO you have no current documentation and no plan. That is a risk flag, not a reassurance.

❌

WRONG DELIVERABLE

"We sent our SOC 2 report and assumed that would satisfy the CRA question"

SOC 2 is an organizational security attestation under AICPA standards. CRA requires product-specific documentation under EU regulation: Article 31 + Annex VII technical documentation, Article 13 risk assessment, Article 28 + Annex V declaration of conformity. A CISO asking about CRA expects CRA documents, not SOC 2.

❌

TIMELINE MISMATCH

"We told the CISO we will hire a consultant and get back to them in 3 months"

Three months is a vendor review cycle. The CISO may need to complete their assessment within weeks. If you cannot produce CRA documentation within the review window, you are evaluated as a non-compliant vendor. CRACheck produces the documentation in 15-25 minutes — within the same business day the CISO asks.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Immediate answer to "What is your product's CRA classification?" Annex III category and conformity assessment path.

Technical Documentation

Art. 31 + Annex VII dossier. The core document the CISO's team will review: architecture, security design, component inventory, conformity references.

Risk Assessment

Per Article 13(2)-(3). Demonstrates structured threat analysis specific to your product. CISOs evaluate vendors on the quality of their risk assessment process.

User Information

Annex II. Shows the CISO what security information you provide to users of your product.

Declaration of Conformity

Art. 28 + Annex V. The formal declaration of CRA compliance. This is the document the CISO will file in their vendor assessment record.

CVD Policy

Annex I, Part II. Shows the CISO your vulnerability handling process. Critical for their third-party risk evaluation.

Notification Template

Art. 14. Demonstrates you have incident notification procedures aligned with ENISA requirements. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Shows the CISO you are tracking CRA milestones proactively.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 LOSE THE CONTRACT OR WAIT

$100K–$500K+

Annual contract value at risk. Or delay response while hiring a consultant: €15K–€25K, 8-16 weeks. The CISO does not wait 16 weeks.

✓ CRACHECK

€149

€149. 15 minutes. Respond to the CISO today. Keep the contract. The documentation pays for itself with the first email you send back.

Two layers

● LAYER 1

Documentation (CRACheck)

Generates the specific CRA documents the CISO's vendor assessment process requires. Structured, regulation-referenced, ready to attach to your response.

∅ LAYER 2

What CRACheck does NOT do

Does not conduct a security audit of your product. Does not provide a compliance certificate. Does not guarantee the CISO will approve your vendor assessment. Does not replace your ongoing security practices. The documentation reflects what you declare — the substance must be real.

CRACheck gets the documentation out the door today. Your security engineering ensures the documentation is truthful. The CISO evaluates both.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Essential requirements + manufacturer obligations (Art. 64(2))

€15,000,000 / 2.5%

Essential requirements / manufacturer obligations.

🟠

Documentation and conformity obligations (Art. 64(3))

€10,000,000 / 2%

Documentation and conformity obligations.

🟡

Misleading information (Art. 64(4))

€5,000,000 / 1%

Misleading information to authorities.

Alternatives

Criteria	"We are working on it"	Engage a law firm	Internal legal team	CRACheck
Response time to CISO	Immediate (but empty)	8-16 weeks	4-8 weeks	Same day
Contract retention risk	High	Medium (delayed)	Medium (delayed)	Low
Cost	€0 + lost contract	€15,000-€25,000	Staff hours ($20K+)	€149
Documentation quality	None	High but delayed	Varies	Structured, immediate

The CISO's questionnaire covers multiple products in your portfolio?

If your European customer uses three of your products, they may request CRA documentation for each. Generate one dossier per product. Volume pricing: 10 products at €99, 30 at €79.

Request Volume Pricing

Response within 24 business hours.

What CRACheck guarantees and what it does not

CRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy of that information is your responsibility as the manufacturer.

We guarantee the document structure follows Article 31 + Annex VII and that legal references cited are correct. We do not guarantee that a specific CISO or vendor assessment process will approve your product.

CRACheck is not legal advice. For specific questions about your vendor relationship or contractual CRA obligations, consult your legal team.

Frequently asked questions

What exactly does a CISO expect when they ask about CRA compliance?

A European CISO conducting vendor assessment typically expects evidence of three things: (1) that you have identified your product's CRA classification under Annex III of Regulation (EU) 2024/2847, (2) that you have produced technical documentation per Article 31 + Annex VII, including a cybersecurity risk assessment per Article 13(2)-(3), and (3) that you have a vulnerability handling process per Annex I, Part II. CRACheck produces all three as structured PDFs.

Is the CISO's request legally binding, or is it voluntary?

The request itself is contractual, not regulatory. However, it is driven by the CISO's own regulatory obligations. If their organization falls under DORA (Regulation (EU) 2022/2554) or NIS2 (Directive (EU) 2022/2555), they must manage ICT third-party risk, which includes evaluating vendor cybersecurity. Refusing to provide documentation does not violate CRA, but it may cause contract termination or non-renewal.

Can we provide CRA documentation now even though enforcement starts in 2027?

Yes, and it is advisable. Producing Article 31 documentation before the enforcement date demonstrates proactive compliance. The documents are valid from the date of production. Early documentation also gives you time to iterate and improve based on feedback from your EU customers.

The CISO asked for a "CRA compliance certificate." Can CRACheck produce that?

CRA does not create a compliance certificate as such. For Default category products, the manufacturer performs a self-assessment under Module A (Annex VIII) and issues a declaration of conformity per Article 28 + Annex V. CRACheck generates this declaration. For Important Class II or Critical products, a notified body assessment is required per Article 32(3). CRACheck does not replace notified body involvement for those categories.

We have multiple EU customers. Do we need separate documentation for each?

No. CRA documentation is per product, not per customer. One Article 31 dossier per product covers all EU customers. If you sell the same product to 50 European companies, one dossier serves all 50.

Is CRACheck a subscription?

No. One-time payment. 30 days of editing, 10 regenerations. The PDF is yours to keep.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, activating the license constitutes express consent for immediate digital content generation. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate with the updated generator version at no additional cost during your license period.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act
Regulation (EU) 2022/2554 — DORA

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.