The term "CRA certification" is commonly used but technically imprecise. The Cyber Resilience Act uses "conformity assessment." For Default products — which include approximately 90% of IoT devices — conformity assessment is Module A: internal control. You, the manufacturer, assess whether your product meets the essential cybersecurity requirements of Annex I, produce technical documentation under Annex VII, draft the EU Declaration of Conformity under Annex V and affix CE marking. No external body is required for Default products. CRACheck generates the 8 documents you need. 15-25 minutes. €149. Browser-side.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
Seven steps. One afternoon. €149. Your IoT product is ready for the EU market.
Seven steps. One afternoon. €149. Your IoT product is ready for the EU market.
For Default products (90% of IoT devices), no external certification or lab is required. Module A under Art. 32.1(a) is self-assessment: you produce the documentation, you declare conformity, you affix CE marking. A lab or notified body is only required for Important Class I without harmonised standards (Art. 32.2), Class II (Art. 32.3) or Critical (Art. 32.4).
Your existing CE marking covers EMC (2014/30/EU) and possibly RED (2014/53/EU). CE marking under the CRA is a separate conformity declaration for Regulation (EU) 2024/2847. You keep one CE mark, but it must now cover CRA alongside your existing directives. The technical documentation under Annex VII is additional.
Art. 2.1 covers all products with digital elements that have a data connection. A Bluetooth sensor has a data connection. Size and simplicity do not exempt it. The CRA compliance path for a simple Default product is proportional: Module A, 8 documents, 15 minutes, €149.
First time exporting to the EU? Here is what each document does and why you need it.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No product data is transmitted to any server.
Guides you through the CRA documentation process step by step. Generates 8 professional PDF documents. For Default products, this is all you need for CRA compliance.
CRACheck does not handle EMC testing, RED radio certification, LVD safety testing or any physical product testing. For a complete CE dossier, you also need these — your local testing lab handles them.
CRACheck handles CRA. Your testing lab handles EMC/RED/LVD. Together, your EU market access is complete.
Article 64 establishes three tiers of administrative fines. Penalties are calculated per undertaking — but non-compliance on a single product can trigger inspection of your entire portfolio.
Art. 64.2. Up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.
Art. 64.3. Up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Includes failure to produce Annex VII documentation.
Art. 64.4. Up to €5 million or 1% of total worldwide annual turnover, whichever is higher.
Art. 64.5 accounts for the nature, gravity and duration of the infringement, and gives consideration to microenterprises, small and medium-sized enterprises, including start-ups.
| Alternative | Cost | What you get |
|---|---|---|
| European regulatory consultant | €5,000–€15,000 | Full guidance. 2-4 months. |
| Read the Regulation yourself | €0 + weeks | 81 pages of regulatory text. High risk of misinterpretation. |
| Skip CRA and hope nobody checks | €0 now | Up to €10M fine. Product withdrawal. EU market ban. |
| CRACheck | €149 | Guided process. 8 docs. 15 min. No prior EU knowledge needed. |
Each product needs its own CRA dossier. Volume pricing: €99/product (10-pack), €79/product (30-pack).
Request volume pricingCRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness and truthfulness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct as of the last verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a commercial buyer in a procurement process.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.