Cyber Resilience Act compliance, from classification to CE marking.
Classify your product by its core function, check every Annex I requirement, build the risk assessment and generate the technical file. Free for manufacturers, with an expert review when you want one.
No card · EU hosted · Built on Regulation (EU) 2024/2847
Does the Cyber Resilience Act apply to your product?
Any hardware or software with a data connection, sold in the EU, is in scope. The exclusions follow the product, not the company: a medical device is out, the same company's industrial gateway is in, and railway equipment is not excluded at all.
Has a data connection to a device or networkArticle 2(1)
YesPlaced on the EU marketArticle 3(22)
YesCovered by a sectoral exclusionmedical · vehicles · aviation · marine · defence
NoYour role in the supply chainmanufacturer · importer · distributor
ManufacturerNext: classify by core function
Classify by core function, with the exact reference.
The class decides whether you self-assess or need a notified body. It depends on what the product is for, not on what it contains: a router with a built-in firewall is still a router. Try it.
Every essential requirement, one by one.
Fourteen product requirements and eight for vulnerability handling. For each one you record whether it applies, how you meet it and the evidence. The readiness score is the share you can actually show.
A risk assessment built from your attack surfaces.
Tell Regulus how the product connects. It proposes the threats for each surface, links each one to the Annex I requirement it affects, and turns your decisions into the risk assessment the technical file needs.
Nine documents in Word. Nothing invented.
The documents are written from what you recorded. Where information is missing they say so, as pending, and list it. You download editable Word files, one by one or as a single pack.
24 hours, 72 hours, 14 days.
An actively exploited vulnerability starts three clocks. Regulus works out each deadline, what goes in each report and what you have already sent through the ENISA single reporting platform.
Everything the CRA asks you to keep.
Import your SBOM
CycloneDX in, components and versions out, where Annex VII expects them.
Track vulnerabilities
Severity, status and the actively exploited flag that starts the reporting clocks.
Write policies once
Disclosure, update and support policies apply to every product until you override them.
Keep every report on record
Reference, date and who sent it, for each stage of each notification to ENISA.
One workspace per client
Consultancies switch between clients and deliver the documents under their own name.
Ask for an expert review
An independent specialist reviews the classification and the documents before you sign.
Where does your product sit? One guide per product type, more every week.
Are Firewalls Class II
Class II
Are Routers Class I
Class I
Are Smart Locks and Security Cameras Class I
Class I
Is a Connected Toy Class I or Default
Class I or default
Are Smartwatches and Wearables Class I
Class I or default
Are VPNs, Antivirus and Operating Systems Class I
Class I
Is a Microcontroller Class I, II or Critical
Default to critical
Is an IoT Gateway Class I, Class II or Default
Usually default
Is a PLC Class II
Usually default
Are Smart Meter Gateways Critical Products
Critical
Where the Cyber Resilience Act stands today.
Two deadlines have already passed. The rest of the regulation applies from 11 December 2027, and notified body capacity for Class II products is already the bottleneck. All CRA deadlines →
Entry into force
The regulation is published and the transition period starts.
Notified bodies
Rules for designating conformity assessment bodies apply.
Reporting
Actively exploited vulnerabilities and severe incidents must be reported.
Full application
Essential requirements, conformity assessment and CE marking.
Do it yourself, have it reviewed, or hand it over.
Self-service
- Classification by core function
- All 22 Annex I requirements
- Risk assessment and threat model
- Nine documents in Word
Expert review
- Classification checked and justified
- Corrections to every document
- A written conclusion you can file
- Answer within two working days
Done for you
- Send us the product details
- We write the classification and the file
- Delivered in the platform and in Word
- Five working days, no calls
Start without an account.
CRA Scope Wizard
Whether the CRA covers your product, and in which class.
Hours and costCRA Cost Calculator
What compliance will cost, with the model in plain sight.
Annex VDoC Generator
The EU declaration of conformity, filled in and ready to sign.
PDFCRA Readiness Checklist
Every obligation on two pages, for the first internal meeting.
Cyber Resilience Act questions, answered.
What is the Cyber Resilience Act?
Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), sets cybersecurity requirements for products with digital elements sold in the EU: hardware and software that connect to a device or a network. Manufacturers must design products securely, handle vulnerabilities for the support period, report actively exploited vulnerabilities and keep a technical file.
When does the CRA apply?
It entered into force on 10 December 2024. The rules on notified bodies apply since 11 June 2026, the reporting obligations of Article 14 since 11 September 2026, and the rest of the regulation from 11 December 2027.
Does the CRA apply to SaaS?
Pure software as a service is generally outside the CRA and falls under NIS2. A remote data processing solution is in scope when the product cannot perform one of its functions without it.
What is the difference between Class I and Class II?
Both are important products listed in Annex III. Class I products can be self-assessed only if harmonised standards, common specifications or a European cybersecurity certificate cover the requirements in full. Class II products always need a notified body or a European cybersecurity certificate.
What documentation does the CRA require?
A technical file under Annex VII, including the cybersecurity risk assessment, how each essential requirement of Annex I is met, the SBOM, the test reports, the vulnerability handling process and the EU declaration of conformity, plus user information under Annex II.
Is Regulus a notified body?
No. Regulus writes the classification, the risk assessment and the documentation, and reviews them. We do not certify anything and we never will: whoever assesses a product should not have written its technical file.
Know your class. Build your file. Sign with confidence.
Free for manufacturers. An expert is one click away when you want one.