Generate 8 PDF documents per Regulation (EU) 2024/2847: product classification, Annex VII technical documentation, cybersecurity risk assessment, EU declaration of conformity, CVD policy, Art. 14 notification template and obligations calendar. 30 minutes. €149 per product. No subscription.
Generate my CRA documentation → Free test: does your product need CRA technical documentation?Each document covers a specific obligation under Regulation (EU) 2024/2847. Each one cites the exact articles that underpin its content.
Per Arts. 2, 7 and 8 and Annexes III/IV. Determines whether your product falls under the CRA, its category (Default, Class I, Class II or Critical) and the applicable conformity assessment procedure.
The core document. Covers the 8 points of Annex VII per Art. 31: general description, design and development, cybersecurity risk assessment, support period, standards and test reports.
Per Art. 13(2)-(4) and Annex I. Maps the 13 product property requirements (Part I) and the 8 vulnerability handling requirements (Part II) against your product.
Per Art. 28 and Annex V. Signed document declaring that the product meets the essential requirements of Annex I. The basis for CE marking (Art. 30).
Per Annex II: 9 mandatory points that must accompany the product. Includes single point of contact, CVD policy, support period, secure commissioning and decommissioning.
Per Annex I, Part II, point 5. Structured CVD policy: intake, triage, remediation, disclosure and record-keeping. Mandatory for every manufacturer.
The 3 mandatory phases: early warning (24h), notification (72h) and final report (14 days). For actively exploited vulnerabilities and severe incidents. Mandatory from September 2026.
All CRA key dates in chronological order: conformity body notification (Jun 2026), reporting obligations (Sep 2026), full application (Dec 2027). With Art. 64 penalty framework.
See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.
Regulation (EU) 2024/2847 applies horizontally to all products with digital elements. CRACheck generates technical documentation for all four categories. Check which one applies to you before purchasing.
CRACheck generates Annex VII technical documentation for any product with digital elements placed on the EU market. Applies to manufacturers (Art. 13), importers (Art. 19), distributors (Art. 20) and authorised representatives (Art. 18).
These categories are outside the CRA because they are already regulated under other EU sectoral legislation. They do not need CRA documentation.
These products fall under the CRA but their conformity assessment requires a notified body. CRACheck generates the base documentation; the third-party assessment is a separate step.
Not sure about your case? Take the free test first. If CRACheck is not the right tool for your product, we tell you before you buy.
Manufacturers (Art. 13), importers (Art. 19), distributors (Art. 20) and compliance officers of products with digital elements marketed in the EU.
Art. 64 of Regulation (EU) 2024/2847 establishes three tiers of administrative fines. In addition, market surveillance authorities can order product withdrawal, market ban or recall.
Up to €15,000,000 or 2.5% of total worldwide annual turnover, whichever is higher. Covers: product without essential cybersecurity requirements, missing risk assessment, no security updates, failure to report actively exploited vulnerabilities or severe incidents to CSIRT and ENISA. For SMEs and startups: the lower of the two amounts applies. Art. 64(2) of Regulation (EU) 2024/2847.
Up to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher. Includes: missing technical documentation (Art. 31), absent or incorrect EU declaration of conformity (Art. 28), misuse of CE marking (Art. 30), importer and distributor non-compliance, missing conformity assessment procedures. Art. 64(3) of Regulation (EU) 2024/2847.
Up to €5,000,000 or 1% of total worldwide annual turnover, whichever is higher. Triggered when the economic operator provides incorrect, incomplete or misleading information to market surveillance authorities or notified bodies in response to a request. Art. 64(4) of Regulation (EU) 2024/2847. On top of fines: product withdrawal, marketing ban and mandatory recall.
No small print. Read this before buying so you know exactly what you get for €149.
Compare the four models available on the market for documenting products with digital elements under Regulation (EU) 2024/2847.
| Criteria | Traditional consultancy | SaaS compliance platform | Generic templates | CRACheck |
|---|---|---|---|---|
| Price | €3,000 – 30,000 per product | €300 – 1,500/month | €0 – 500 | €149 per product (one-time) |
| Turnaround time | 4 – 12 weeks | Setup: 2 – 4 weeks | Variable (you do everything) | 30 minutes |
| Documents generated | Variable by scope | Variable by plan | 1 – 3 templates | 8 PDF documents in ZIP (~40 pages) |
| Article coverage | Customised | Partial (SBOM/CI focus) | Shallow | Arts. 2, 7, 13, 14, 28, 31 + Annexes I, II, III, IV, V, VII |
| Data in browser | Your data goes to the consultant | Your data goes to their servers | Local (manual) | 100% browser-side · Zero data to server |
| Commercial model | Per-project engagement | Monthly recurring subscription | No commitment | One-time payment, no subscription |
| Legal basis cited | Varies | Varies | No | Art. 31 + Annex VII of Regulation (EU) 2024/2847 |
Consultancy price ranges based on published market rates for CRA cybersecurity services. SaaS ranges based on public pricing of compliance platforms (€300–1,500/month segment). No specific brands cited.
It’s not that it’s cheaper. The model is different.
Regulation (EU) 2024/2847 places the responsibility for technical documentation on the manufacturer (Art. 13(12)). CRACheck inverts the consultancy model: you, as the manufacturer, assess your own product requirement by requirement, guided by the generator questions that map the 21 points of Annex I. CRACheck structures your assessment into 8 professional documents per Annex VII.
CRACheck is JavaScript running on your machine. There is no server processing your product data, no database, no storage. The generation of all 8 PDFs happens locally and you download the ZIP directly. You can disconnect from wifi after loading the page and the generator keeps working. GDPR-native by design.
The 8 documents you download are not tied to any active subscription. In three years they are still valid without paying another euro. SaaS compliance platforms force you to renew to keep access to your reports. Here, the ZIP is a portable package that survives your commercial relationship with us.
Without technical documentation per Annex VII, your product cannot bear the CE marking or be legally marketed in the EU from December 2027. One licence per product. One-time payment. No subscription.
3 steps. 30 minutes. No prior regulatory knowledge required.
Company name, manufacturer details, product name and description, version, product type (software, hardware, IoT, component), country of marketing. The generator pre-structures the Annex VII fields point by point.
Classification per Arts. 2, 7 and 8 (Default, Class I, Class II, Critical). Assessment of the 13 product property requirements (Annex I, Part I) and the 8 vulnerability handling requirements (Part II). Support period, SBOM and applied standards.
Direct download in your browser. 8 professional documents (~40 pages) ready to archive, share with importers, present to notified bodies or deliver upon request from a market surveillance authority. No server involved.
Important notice on product scope. CRACheck generates technical documentation per Annex VII of Regulation (EU) 2024/2847. It is not a third-party audit. It does not replace conformity assessment by a notified body when required under Arts. 32(2) and 32(3) of the Regulation.
For Important Class II products (Annex III) and Critical products (Annex IV) requiring third-party conformity assessment, CRACheck generates the base documentation that the notified body will review. Annex VII documentation is a prerequisite for conformity assessment, not a substitute. For Default category products (~90% of the market), internal self-assessment per Module A (Annex VIII, Part I) is the standard procedure.
Commercial honesty about the product scope and how refunds work for downloadable digital content.
CRACheck generates a set of structured documents per Art. 31 and Annex VII of Regulation (EU) 2024/2847, based on the information you, as the manufacturer, provide. The accuracy, precision and completeness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Annex VII and that the legal references cited (articles, annexes, obligations) are correct as of the latest verification date. We do not guarantee that a specific dossier will be accepted by a market surveillance authority in a specific case or by a notified body in a conformity assessment procedure.
CRACheck is not legal advice. For specific situations (open inspection, initiated penalty proceedings, third-party conformity assessment), consult a lawyer or regulatory consultancy specialising in cybersecurity.
CRACheck is digital content delivered via download of the ZIP containing the 8 PDF documents generated in your browser. Per Art. 16(m) of Directive (EU) 2011/83 on consumer rights, the right of withdrawal does not apply to digital content whose performance has begun with the express consent of the buyer. The generation of the ZIP constitutes the act of delivery.
Refund for technical failure: if the software fails (generator error, PDF that won’t download, reproducible bug), we issue a full refund upon submission of an error screenshot to hello@solidwaretools.com within 14 days of purchase.
No refund for change of mind once the licence has been activated and the ZIP generated, per Art. 16(m) cited above.
8 PDF documents: product classification, Annex VII technical documentation, cybersecurity risk assessment, EU declaration of conformity, CVD policy, Art. 14 notification and obligations calendar. All in a ZIP, directly from your browser.
One-time payment · No subscription · 30 minutes · 10 regenerations · 30-day editing · Packs from €79/product
Our team reviews EUR-Lex, BOE, JORF, Bundesgesetzblatt and European institutional platforms every Monday and Tuesday. Changes are implemented on Wednesdays. We publish a fortnightly report with the most relevant updates.
Last scan: 27 April 2026 · Next report: 11 May 2026
View regulatory intelligence diary →