Cyber Resilience Act: all tools and articles
Your CRA technical file. Drafted in seconds.
11 documents your product must have by 11 December 2027, drafted from what you tell us about the product.
- Who it applies to
- Every manufacturer of a product in scope: the technical documentation is the file a market surveillance authority asks for.
- The dates
- Drawn up before the product is placed on the market, and kept for ten years or the support period, whichever is longer.
- The one thing to do
- Draft the Annex VII file against your product, then keep it current with each release rather than rebuilding it for an audit.
11
documents, the Annex VII set
Seconds
to deliver, the moment payment confirms
€2,000
the technical file, drafted
excl. VAT · one payment · per product · by card
The Commission's own estimate for a manufacturer's self-assessment is €18,400 per product, with the technical documentation, CE marking, declaration and reporting on top at a further 9% of development cost, a survey figure it says it could not verify (SWD(2022) 282, 2022). The technical file is the documented part of that job.
Price
€2,000
once, per product, excl. VAT. No subscription needed; the file stays editable and exportable in your organization.
Drafted from your product record the moment Paddle confirms the payment. Nothing waits on a person.
For
Default category
Installed or downloadable software, apps, libraries, and devices not listed in Annex III or IV. Self-assessment under module A.
What is in the file
11 controlled documents: the seven Annex VII lists, then the four operating documents Annex I Part II presumes you have. Each is versioned, approved and hash-chained in your organization, and exports as a PDF with the sha256 of the approved text in the footer, so the file you hand an authority in 2029 is provably the file approved in 2026.
The 22 Annex I requirements the file has to show, as one table
The documents are drafted in English, under the titles below. The Regulation fixes no language for the technical file: Article 13(22) requires it in a language the requesting authority can easily understand, which makes translation a task for when an authority asks, not before. The one exception is the user information under Annex II, which has to be in a language your users understand, and the document says so where it applies.
| The document | Where the annex asks for it |
|---|---|
| Scope and classification determination | Article 3 and Annex III |
| General description and user information | Annex VII point 1, Annex II |
| Cybersecurity risk assessment | Annex VII point 3, Annex I Part I |
| Vulnerability handling process | Annex VII point 2, Annex I Part II |
| Support period determination | Annex VII point 4, Article 13(8) |
| Standards applied and test evidence | Annex VII points 5 and 6 |
| EU declaration of conformity (draft) | Annex VII point 7, Annex V |
| Coordinated vulnerability disclosure policy | Annex I Part II points 5 and 6 |
| Security updates and support statement | Annex I Part II points 2, 7 and 8, Article 13(8) |
| Software bill of materials procedure | Annex I Part II point 1 |
| Article 14 reporting procedure | Article 14, Article 71(2) |
How it goes
- 1Create your organization. Free, two minutes, no card. The pack needs somewhere to be delivered: your own StandardOS organization, where the documents version, lock and export.
- 2Record the product. Name, versions, what it does, how it reaches the market, which Annex III or IV entry you considered, the support period and why. Then the Annex I checklist: every requirement, applicable or not, and how it is met. Ten minutes for a product you know.
- 3Pay at checkout. By card, through Paddle, who is the merchant of record and handles VAT. €2,000 once, per product.
- 4The file is drafted. Within seconds of the payment confirming, eleven controlled documents appear in your organization, each already saying everything the record holds and marking what still has to be written. Edit, approve, lock, export as PDF with the hash in the footer, or download the whole file as one bundle.
Default, important or critical: the tier goes on page one
Annex III lists 19 categories of important products in class I and 4 in class II; Annex IV lists 3 critical ones. Everything else in scope is default. The tier decides whether you may assess conformity yourself or need a notified body (Article 32); it does not change the file's contents or the reporting duty. The pack's scope document records which tier and why, quoting the row.
What it is not
- Not security testing. The file indexes the test reports you hold; it does not produce them.
- Not a notified body's assessment. Products in Annex III class II or Annex IV need one; the file is still the documentation the notified body starts from.
- Not legal advice. It is the documentation the Regulation names, drafted from your facts, for you to complete and approve.
- Not a shield from product liability. Under the Product Liability Directive a court can order the file disclosed, and a breach of the CRA presumes the defect: which way the two acts run.
- Not a subscription. Keeping the file current afterwards, as versions and components change, with the integrations reading your systems, is what the €249/mo product is for. Your choice.
Buy it
Create your organization, record the product, pay. The file is drafted the moment the payment confirms.
Article 13 and Annex VII are short enough to read yourself: Regulation (EU) 2024/2847. This page is not legal advice.