Regulation (EU) 2024/2847 — the Cyber Resilience Act — requires Annex VII technical documentation for every product with digital elements placed on the EU market. Manufacturers need it. Most cannot produce it internally. The professional who offers structured CRA documentation as a service captures a new, recurring revenue stream with every client. CRACheck Professional Pack: 70 licenses, €1,199 one-time. 8 structured PDF documents per product. Generated in your browser in 20 minutes.
€1,199 · One-time · 70 dossiers · 8 PDFs each · Your data never leaves your browser
Every manufacturer of connected products — from smart home to industrial IoT, from consumer electronics to SaaS platforms — will need Annex VII technical documentation. The professional who can deliver it at scale has a structural advantage over those who draft each dossier from scratch.
CRACheck Professional Pack is built for any professional who delivers — or intends to deliver — CRA compliance documentation to multiple clients.
Three inputs. Four answers. No signup required.
Every license generates a complete Annex VII technical documentation package. Each document cites the specific article of Regulation (EU) 2024/2847 it complies with. The client does not need access to the tool — the professional enters the data and delivers the finished package.
Default / Important Class I / Important Class II / Critical. Annex III + Annex IV analysis.
Complete technical file structure. Product description, design, development, cybersecurity risk assessment methodology.
Systematic assessment against the 13 essential requirements of Annex I Part I. Article 13.2.
8 requirements of Annex I Part II. Coordinated vulnerability disclosure policy, SBOM reference. Article 13.6.
Per Annex V. Manufacturer identification, product identification, conformity assessment. Article 28.
Per Annex VI. Short-form declaration with URL reference. Article 13.20.
Printable label with CE marking, support period end date, manufacturer contact. Article 30.
Pre-structured template for reporting vulnerabilities to CSIRT/ENISA within 24 hours. Article 14.
See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.
A single Annex VII dossier covers the 13 essential cybersecurity requirements of Annex I Part I, the 8 vulnerability handling requirements of Annex I Part II, the risk assessment per Article 13.2, the Declaration of Conformity per Annex V, and the CE marking per Article 30. Researching the regulation, structuring the document, and mapping each section to the correct article takes 15-20 hours per product. At that rate, serving 30-40 clients consumes the entire capacity of a senior professional for months.
Generic cybersecurity assessment templates, ISO 27001 checklists, and NIST frameworks do not map to the specific structure of Regulation (EU) 2024/2847. The CRA has its own essential requirements (Annex I), its own documentation requirements (Annex VII), its own conformity assessment procedures (Article 32), and its own vulnerability handling obligations (Annex I Part II). A dossier built on a generic template will miss CRA-specific elements that market surveillance authorities expect to see.
CRA compliance documentation is a new service category. Every manufacturer of connected products will need it before December 2027. The professional who offers it now — while the market is still forming — establishes the client relationship, builds expertise, and captures revenue that competitors will pursue later. Waiting until enforcement is not a strategy — it is a concession to the competition.
8 structured PDF documents per product. Cybersecurity risk assessment, vulnerability handling, Declaration of Conformity, CE marking guidance, notification template. Generated from input data in 20 minutes. Article-by-article traceability to Regulation (EU) 2024/2847.
Penetration testing, firmware analysis, secure boot implementation, SBOM generation from source code, vulnerability scanning, security architecture review. These are implementation-level services. CRACheck documents the cybersecurity posture — it does not create it.
CRACheck structures and documents. The professional advises, coordinates, and implements. The two layers complement each other — and together they form a complete CRA compliance service.
These are the consequences under Article 64 of Regulation (EU) 2024/2847. This is the conversation to have when a client asks whether CRA documentation is really necessary.
Article 64.2 of Regulation (EU) 2024/2847. Whichever is higher.
Article 64.3. Covers failure to produce Annex VII technical documentation, CE marking, and vulnerability reporting.
Article 54. Corrective measures, withdrawal, or recall if documentation is insufficient.
The clients face these consequences. The professional who delivers documentation prevents them — and builds a service business on the obligation.
| Option | Cost for 40 products | Total time | Output quality |
|---|---|---|---|
| Manual drafting (Word templates) | Professional time only | 720+ hours | Variable, no CRA-specific structure |
| Outsource to another firm | €60,000-€120,000 | Depends on provider | High, but eliminates your margin |
| Enterprise SaaS platform | €8,000-€20,000/year | 2-4 weeks setup | High, requires integration |
| CRACheck Professional Pack | €1,199 (one-time) | ~13 hours total | Structured, Annex VII, article-by-article |
CRACheck generates a structured documentation package according to Annex VII of Regulation (EU) 2024/2847 from the information that the user enters. The truthfulness, accuracy and completeness of that information is the responsibility of the manufacturer — or of the professional entering data on their behalf.
We guarantee that the document structure follows Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct as of the latest verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority or by a commercial buyer in a procurement process.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.
70 licenses. 8 PDF documents per product. Annex VII structure. Browser-side. One payment.