The technical documentation Article 31 and Annex VII require of a manufacturer, as eleven documents for one product, delivered as PDF and DOCX, generic placeholders where your product goes.
List price €3,000
€2,000
33% off the list price, introductory, until 30 Nov 2026Documents by email within minutes; add them to a free workspace whenever you like.
excl. VAT · one payment · invoice from Paddle · no account
- Scope and classification determination
- General description and user information
- Cybersecurity risk assessment
- Vulnerability handling process
- Support period determination
- Standards applied and test evidence
- EU declaration of conformity (draft)
- Coordinated vulnerability disclosure policy
- Security updates and support statement
- Software bill of materials procedure
- Article 14 reporting procedure
CRA technical file, done for you: €2,900
The pack's 11 documents, filled for your product.
The 11 documents
Every document by name, one line on what it settles, and the point of the Regulation it satisfies.
Article 3 and Annex III
Scope and classification determination
Whether the product is in scope, and its class under Annex III, with the reasoning.
Annex VII point 1, Annex II
General description and user information
What the product is, what it does and what the user is told, per Annex II.
Annex VII point 3, Annex I Part I
Cybersecurity risk assessment
The Article 13 risk assessment against every Annex I Part I requirement.
Annex VII point 2, Annex I Part II
Vulnerability handling process
How vulnerabilities are found, fixed and communicated, per Annex I Part II.
Annex VII point 4, Article 13(8)
Support period determination
How long security updates are provided and why, per Article 13(8).
Annex VII points 5 and 6
Standards applied and test evidence
Which standards and specifications apply and the evidence that tests were run.
Annex VII point 7, Annex V
EU declaration of conformity (draft)
The declaration of conformity, ready for the signature, per Annex V.
Annex I Part II points 5 and 6
Coordinated vulnerability disclosure policy
The coordinated vulnerability disclosure policy the Regulation requires to be published.
Annex I Part II points 2, 7 and 8, Article 13(8)
Security updates and support statement
What updates are provided, how, for how long, and where the user reads it.
Annex I Part II point 1
Software bill of materials procedure
How the software bill of materials is produced, in which format, and kept current.
Article 14, Article 71(2)
Article 14 reporting procedure
Who reports what to ENISA and the CSIRT, and the 24-hour, 72-hour and 14-day steps.
Done for you
CRA technical file, done for you
We fill the pack's 11 documents for your product from your intake, and deliver them as editable DOCX and PDF.
€2,900
excl. VAT, once, per product
No account needed.
Paid through Paddle, our merchant of record; VAT is added or reverse-charged at checkout.
- Who does the work
- We do the work, and we are your contact from the first call to delivery.
- How it starts
- A short form after you pay, one call of about an hour, and your documents.
- How long
- 10 working days from the day the intake is complete, Monday to Friday; 24 December to 1 January does not count.
- If we miss the date
- Full refund if we miss the date we confirmed, through our fault.
What we deliver
The 11 documents, filled for your product
Every document of the pack, written for your product from your answers and your documents.
Product class and conformity route decided
Whether the product is default, important or critical under Annex III or IV, and which conformity assessment module follows, with the Article it rests on.
What only you can supply, listed
A missing test report, SBOM or signature is marked, never invented, and listed for you to close.
EU co-funding: SECURE's second open call pays 50% of eligible costs of a CRA compliance project for an EU or EEA SME, up to €30,000 per grant, until 11 December 2026. Work by external providers can be an eligible cost. Your company applies itself and SECURE decides, so we cannot promise this order is funded. What the call funds, and who may apply
What you provide
- One product with digital elements per order: its name, version and intended use.
- What exists already: architecture, components, the update process, any security testing and the standards you apply.
- A person who knows how the product is built, for one call and for questions in writing.
What is not included
- No legal opinion.
- No notified body involvement and no conformity assessment by a third party.
- No certification and no CE marking: you sign the declaration and affix the marking.
The terms of the order
Besides the software, StandardOS sells fixed-price done-for-you services. StandardOS prepares a defined set of documents for one machine, one product or one organization, as the offer's own page describes. They are delivered as files you may edit and keep. The price is fixed and paid in advance through Paddle, as for the subscription.
The work starts from an intake: a short form, one call and your documents. The working days stated on the offer run from the day we confirm the intake is complete. They are Monday to Friday and never fall from 24 December to 1 January. We confirm the delivery date in writing that day.
Full refund if we miss the date we confirmed, through our fault. Refund requests go to support@getstandardos.com, and an approved refund returns to the original payment method.
Not included: a legal opinion, a conformity assessment by a notified body, and certification. Notified bodies and certification bodies are independent of StandardOS: you choose, contract with and pay them directly, and StandardOS receives nothing from them.
Done-for-you services are sold to businesses only, so the consumer right of withdrawal does not apply.
What you get
A sample page
The first page of the Cybersecurity risk assessment, as it arrives: PDF and DOCX, the generic placeholders in square brackets are what your workspace fills in.
Regulation references
Every document names the article or annex point it satisfies; the Official Journal text is the source, read in English.
- Article 3 and Annex III
- Annex VII point 1, Annex II
- Annex VII point 3, Annex I Part I
- Annex VII point 2, Annex I Part II
- Annex VII point 4, Article 13(8)
- Annex VII points 5 and 6
- Annex VII point 7, Annex V
- Annex I Part II points 5 and 6
- Annex I Part II points 2, 7 and 8, Article 13(8)
- Annex I Part II point 1
- Article 14, Article 71(2)
In a workspace
A workspace created, or an owner signing in, with the buyer's address claims the purchase once. The same 11 documents are then drafted from the product you register, kept current as the record changes, and exported with the audit trail. The trial is 7 days, no card.
The terms
- One payment; the invoice comes from Paddle, our merchant of record, with VAT for your country.
- The documents are yours to edit and keep; a link that has expired is re-sent on request.
- Cancellation and refund terms are on the cancellation page. Cancellation and refund
Who it is for
- A manufacturer of software or a connected product placed on the EU market, with a technical file to show from 11 December 2027.
- A team that would rather start from a complete, structured set than from the Regulation's text.
- A consultancy drafting the file for a client, one set per product.
Who it is not for
- A product outside the Regulation's scope; the scope check on the CRA hub is free.
- An importer or distributor: the importer and distributor pack is the one with your duties.
- A team that needs the file kept current across releases: that is the workspace's job, not a file's.
How delivery works
1. Pay
Paddle takes the payment in the overlay on this page and issues the invoice, VAT handled for your country.
2. Receive
Within minutes an email carries a link, good for 30 days, to the set as PDF and DOCX.
3. Use, or claim
Edit the DOCX yourself, or create a free workspace with the same email: the purchase attaches to it and the documents are drafted again from your own product record.
Questions
- Is this the full technical documentation Annex VII asks for?
- It is the structure and the drafted text of every Annex VII point; the product-specific facts, test results and the SBOM are yours to fill in, and the placeholders show where.
- Do I need an account to buy it?
- No. Paddle takes the payment on this page and the documents arrive by email. A free workspace can claim the purchase later if you want them drafted from your own product record.
- Which product classes does it cover?
- Default products under self-assessment (Module A). An important or critical product needs the same file plus a conformity route the documents name; the scope determination in the pack decides which.
- In which language are the documents?
- English, and every document is DOCX as well as PDF so it can be translated: where a notified body is involved, Article 31(4) puts the file in an official language of that body's member state or in one the body accepts, and a market surveillance authority can ask for it in a language it understands. The page and the support are in yours.
- What does the workspace add?
- The same eleven documents drafted from the product you register, the Article 14 clocks, the notifications drafted when a vulnerability is exploited, and an export with the audit trail.
The other path
€249 a month runs the same file live: register the product, the workspace drafts every document from its record, keeps the clocks and stays current.
Open the workspace