You are a software development firm serving European clients — ERPs, SaaS platforms, IoT firmware, fintech applications, analytics tools. Regulation (EU) 2024/2847 requires your clients to exercise due diligence on third-party components (Article 13.5). The software you develop is that component. Contracts are beginning to include CRA Annex VII documentation as a mandatory deliverable. CRACheck Professional Pack: 70 licenses, €1,199 one-time. 8 structured PDF documents per project. Generated in your browser in 20 minutes.
€1,199 · One-time · 70 dossiers · 8 PDFs each · Your data never leaves your browser
European clients are adding CRA compliance documentation to their RFPs and project contracts. The development firm that includes Annex VII documentation as a standard deliverable wins the contract. The one that treats it as out of scope loses it to a competitor that does not.
CRACheck Professional Pack is built for software development firms that deliver products to European clients and need to include CRA documentation as part of the project handover.
Three inputs. Four answers. No signup required.
Every license generates a complete Annex VII technical documentation package. Each document cites the specific article of Regulation (EU) 2024/2847 it complies with. The dossier ships alongside the code as part of the project deliverable.
Default / Important Class I / Important Class II / Critical. Annex III + Annex IV analysis.
Complete technical file structure. Product description, design, development, cybersecurity risk assessment methodology.
Systematic assessment against the 13 essential requirements of Annex I Part I. Article 13.2.
8 requirements of Annex I Part II. Coordinated vulnerability disclosure policy, SBOM reference. Article 13.6.
Per Annex V. Manufacturer identification, product identification, conformity assessment. Article 28.
Per Annex VI. Short-form declaration with URL reference. Article 13.20.
Printable label with CE marking, support period end date, manufacturer contact. Article 30.
Pre-structured template for reporting vulnerabilities to CSIRT/ENISA within 24 hours. Article 14.
See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.
Article 13.5 of Regulation (EU) 2024/2847 requires manufacturers to exercise due diligence when integrating components sourced from third parties. The software you develop is that third-party component. EU clients are already adding contractual clauses requiring development partners to deliver cybersecurity risk assessments, SBOM documentation, and Annex VII technical files. The firm that says "compliance is your responsibility" loses the RFP to the one that includes it in the delivery.
The CRA requires specific documentation: a cybersecurity risk assessment against 13 essential requirements (Annex I Part I), vulnerability handling procedures covering 8 requirements (Annex I Part II), an SBOM, a coordinated vulnerability disclosure policy, and a Declaration of Conformity (Annex V). Standard development artefacts — unit test reports, architecture diagrams, API documentation — do not map to this structure. The client needs CRA-specific documentation, and the development firm is in the best position to produce it.
When two development firms compete for the same EU client project and one includes CRA Annex VII documentation as a standard deliverable, the decision is straightforward. The client saves time, reduces risk, and gets a complete compliance package. CRA documentation capability is becoming a selection criterion in RFPs — not a bonus, but a requirement. The firm that builds this into its delivery process now establishes the standard that competitors will have to match later.
8 structured PDF documents per product. Cybersecurity risk assessment, vulnerability handling, Declaration of Conformity, CE marking guidance, notification template. Generated from product data in 20 minutes. Article-by-article traceability to Regulation (EU) 2024/2847.
Secure coding practices, penetration testing, SAST/DAST scanning, SBOM generation from dependency trees, encrypted communications implementation, secure boot, OTA update infrastructure. These are engineering tasks performed during development. CRACheck documents the cybersecurity posture — it does not build it.
CRACheck structures and documents. The development team builds security into the product. The documentation reflects what was implemented — and together they form the complete compliance package the client needs.
These are the consequences under Article 64 of Regulation (EU) 2024/2847 for manufacturers who place products on the EU market without CRA compliance. These are your clients' risks — and your argument for including documentation in every delivery.
Article 64.2 of Regulation (EU) 2024/2847. Whichever is higher.
Article 64.3. Covers failure to produce Annex VII technical documentation, CE marking, and vulnerability reporting.
Article 54. Corrective measures, withdrawal, or recall if documentation is insufficient.
The clients face these consequences. The development firm that delivers documentation prevents them — and secures the long-term relationship.
| Option | Cost for 30 projects | Total time | Output quality |
|---|---|---|---|
| Manual drafting (internal team) | Senior architect time only | 600+ hours | Variable, not CRA-structured |
| Hire a regulatory consultant per project | €60,000-€120,000 | Depends on provider | High, but erodes project margin |
| Enterprise SaaS platform | €8,000-€20,000/year | 2-4 weeks setup | High, requires integration |
| CRACheck Professional Pack | €1,199 (one-time) | ~10 hours total | Structured, Annex VII, article-by-article |
CRACheck generates a structured documentation package according to Annex VII of Regulation (EU) 2024/2847 from the information that the user enters. The truthfulness, accuracy and completeness of that information is the responsibility of the manufacturer — or of the development firm entering data on their behalf.
We guarantee that the document structure follows Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct as of the latest verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority or by a client in a procurement or audit process.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.
70 licenses. 8 PDF documents per product. Annex VII structure. Browser-side. One payment.