CRA PRODUCT CHECK · FREE
The Cyber Resilience Act covers almost every product with software and a data connection, but not all of them equally strictly. This check places your product under Art. 2 and Annexes III and IV and names the conformity assessment route. An engineer then verifies the classification with you for free, without access to your code.
FREE TOOL
Orientation based on Regulation (EU) 2024/2847 and Implementing Regulation (EU) 2025/2392.
It checks scope first: data connection, the exclusions for medical devices, vehicles, aviation, marine equipment and defense, pure SaaS and non-monetized open source. Then it maps the core function to an Annex III or IV category, as described technically in Implementing Regulation (EU) 2025/2392, and derives the Art. 32 route. The product as a whole counts: an embedded browser does not make a news app a "browser" (its recital 3).
Examples from Implementing Regulation (EU) 2025/2392:
A CRA assessment is the conformity assessment: the manufacturer shows that product and processes meet Annex I, based on a documented cybersecurity risk assessment (Art. 13(2) and (3)). As a checklist:
OFFER
Start here
An engineer confirms the class and lists the conformity assessment, obligations and deadlines.
Free
What you get
PROCESS
Four questions, instant result.
Send the result and your phone number; we ask about the details. No code access.
Class, procedure, deadlines, quote.
CONTACT
The result is attached automatically. An engineer verifies the class and sends the conformity assessment, obligations and deadlines in writing within 48 hours. Free.
Leave your number, I'll call you
Krystof Olik · founder and CEO
Same working day (CET), otherwise the next working morning.
FAQ
No. It follows the Regulation and Implementing Regulation 2025/2392; the class depends on your product’s core function, and the Commission guidance is non-binding too. An engineer verifies the class with you for free.
Yes, with our partner law firm Rowan Legal: we do the technical work and prepare processes and documentation; its lawyers validate them and prepare the contracts.
Not for that reason alone. Integrating a product with the core function of a category does not make the whole product important (Art. 7(1)). The operating system itself is class I when it is sold as a product.
For class II, for critical products without mandated certification, and for class I unless you fully apply harmonized standards, common specifications or a European certification scheme. The rules for notifying such bodies have applied since 11 June 2026.
No. The check runs only in your browser. We receive the result only if you ask for a call.
MORE SERVICES
