For makers of connected devices and software
Build the technical file and Declaration the CRA actually asks for — in hours, not weeks.
Vandorisk tells you whether the EU’s Cyber Resilience Act applies to your product. If it does, it takes you step by step to the technical file and the Declaration of Conformity the law asks you to sign.
The Cyber Resilience Act is Regulation (EU) 2024/2847.
Or see a worked example of the technical file first
Built by an EU cybersecurity assessorDeterministic checks, not AI guessesYou stay in control
Does the CRA apply to your product?
Three quick questions, 60 seconds. No signup.
1. Is it software, or hardware with software in it (firmware, an app), that can exchange data with another device or a network?
2. Is it made available on the EU market (sold, distributed, or imported into the EU)?
3. Is it one of these? Each is either covered by its own EU rules or outside the CRA altogether.
- A medical device or in vitro diagnostic medical device, where the MDR or IVDR applies (Art. 2(2)(a)-(b))
- A motor vehicle, or a system or component type-approved for one (Art. 2(2)(c))
- A civil aviation product certified under Regulation (EU) 2018/1139 (Art. 2(3))
- Marine equipment under Directive 2014/90/EU (Art. 2(4))
- A spare part replacing an identical component, made to the same specification (Art. 2(6))
- Made only for national security or defence, or to process classified information (Art. 2(7))
- A pure online service (SaaS) with nothing to download or install (Art. 3(1)-(2))
01 · How it works
Three steps to documents you can stand behind
In the order an assessor works: scope and class first, then every requirement, then the documents.
Find out where you stand
Whether the CRA applies, which Annex III or IV class your product falls in, and the conformity route that class means. Most products are Default class and self-assess; where a third party is needed, it says so. Find your class, free →
Answer every requirement, with evidence
The Article 13 risk assessment, then each Annex I requirement in plain language, with how to satisfy it and the legal reference. Upload an SBOM and it is screened for known vulnerabilities, with the results attached to your evidence.
Export documents that tell the truth
The Annex VII technical file, the EU Declaration of Conformity and the Annex II user information, as Word documents. Anything missing prints as NOT SUPPLIED, and no clean Declaration exports until the file supports it. See a worked example →
What we guarantee, and what we don’t
- Read the citations. Every requirement carries the provision of Regulation (EU) 2024/2847 it implements, and the technical file prints that citation beside each answer. See them in a worked example →
- See the markers. The technical file contains every Annex VII element, or prints NOT SUPPLIED where one is missing rather than papering over it.
- Try to export too early. No clean Declaration exports while an applicable requirement is unmet. You can export the Declaration of Conformity before every requirement is met: acknowledge each requirement recorded as not met or partly met, and the Declaration is stamped NOT READY on every page. A requirement you have not answered, or a blocker still open, cannot be acknowledged: the Declaration does not export until each one is answered or cleared.
It guarantees nothing about whether your answers are true.
You supply the facts about your product and sign the Declaration; Vandorisk makes sure the file built from those facts is complete, cited and consistent, and shows you plainly where it isn’t yet.
02 · What it looks like
Readiness and the products dashboard
A smart thermostat part-way through its assessment, in the running product. Captured in August 2026 on requirement pack v0.3.0; the current product looks different.
03 · Pricing
What an account actually gets you
The applicability check, the classifier, the 24-hour test and the Learn articles stay open to everyone without an account: an account is what turns those answers into an assessment and the documents that come out of it.
Straight about the state of it: nothing here is metered yet. During the pilot every account can use everything on this page, and the lists below say what each plan is expected to include once pricing starts. Anything not built yet is labelled.
Free
For taking one product all the way through.
- One product, all seven steps: the product, scope, Annex III/IV class, Art. 13 risk assessment, every requirement, readiness, documents
- SBOM upload, screened against OSV, attached to your evidence
- Readiness and evidence-weighted scores, a prioritized gap list, and the blockers that hold the Declaration back
- Annex VII technical file, EU Declaration of Conformity and Annex II user information, as Word documents
- Requirement statuses, the risk assessment and readiness, as JSON
Email and a password. No card.
Professional
For a portfolio you have to keep current.
- Everything in Free, for every product you place on the market
- Versions that carry forward: clone last release’s assessment instead of starting again
- Product families: one assessment across variants that do not differ in their cybersecurity properties
- Teammates with owner, editor and viewer roles
- Evidence register: name the test report behind an answer instead of describing it
- API keys so CI can push an SBOM on every build
- Product-specific test plan & results report (planned)
A few questions, on this page. A person replies with scope and a price. See exactly what you get →
Enterprise
For portfolios and regulated environments.
- Everything in Professional, across every product line you sell
- Run it yourself: the same application as a container in your own network
- Audit trail of who answered what and when, stamped with the pack version
- Priority support and onboarding, with a named contact
- New requirement packs as they ship (RED and the Machinery Regulation are next on the roadmap)
The same few questions, on this page. A person reads it, not an autoresponder.
Ask for a price
A price depends on how many products you have to keep current and how soon you need them defensible, so those are the questions. Tell us that much and a person comes back with the scope and the number. Prefer email? hello@vandorisk.com reaches the same person.
04 · Questions
Questions every team asks
Is this legal advice? Can I rely on it?
No. Vandorisk is guided self-assessment and documentation software, not legal advice, and the manufacturer remains responsible for the Declaration of Conformity. What it gives you is the same thing a good assessor would: the applicable requirements, in order, with evidence captured and documents generated, so the declaration you sign is defensible and traceable.
When do I actually need to act?
Reporting already applies. Since 11 September 2026, an actively exploited vulnerability or a severe incident affecting the security of a product you have on the EU market has to be reported, starting with an early warning within 24 hours. Chapter IV, on notified bodies, has applied since 11 June 2026, so Member States can designate them now. Full application follows on 11 December 2027: the essential requirements, the technical file, the Declaration of Conformity and the CE mark. The Commission's guidance of 27 July 2026 moved none of these dates. A first assessment usually turns up gaps, such as a missing disclosure policy or an undocumented support period, that take months to close. Not sure you could file a report today? The 24-hour test is twelve questions, no signup, nothing stored unless you leave your address.
Take the 24-hour test → · Every CRA date and what it asks of you →
Can I self-assess, or do I need a notified body?
Most products can self-assess: about 90% fall in the Default category, where the manufacturer always may. A Class I product can self-assess only by applying in full a cited harmonised standard, a common specification or a European cybersecurity certificate, and no CRA harmonised standard is cited yet, so for now Class I usually needs a notified body. Class II and Critical products need a third-party assessment or, where one applies, a European cybersecurity certificate. Free and open-source products in either Annex III class may self-assess if their technical documentation is public (Art. 32(5)). Vandorisk tells you which class you are in and which route that means, and prepares the evidence either way.
Find your class, free → · The routes, and what each one costs →
Can I export the Declaration before everything is met?
Only in a form nobody could take for a finished one. You can export the Declaration of Conformity before every requirement is met: acknowledge each requirement recorded as not met or partly met, and the Declaration is stamped NOT READY on every page. A requirement you have not answered, or a blocker still open, cannot be acknowledged: the Declaration does not export until each one is answered or cleared. The Annex II user information can be exported while you work, and the technical file once the product is classified; both are marked DRAFT until every applicable requirement is met and no blocker is open.
Does this apply to software products, or only physical devices?
Both. The CRA covers any product with digital elements, which the regulation defines as software or hardware placed on the market as a product (Art. 3(1)). A standalone app, an operating system, a VPN client, a password manager and firmware are all in scope, under the same rules and routes. A service offered purely online, with nothing to download or install, is generally outside scope, unless it is the remote data processing a covered product needs in order to work; then it is in scope through that product.
Do I have to buy the standards to comply?
No. The standards behind CE-marking cybersecurity cost hundreds of euros apiece and are written for assessors, not product teams. Vandorisk's requirement packs put every applicable requirement in plain language, with how to satisfy it and the exact legal reference. No CRA harmonised standard is cited in the Official Journal yet, so assessment runs against Annex I directly, which is what Vandorisk walks you through.
Does Vandorisk use AI to decide whether I comply?
No. Every check is a fixed rule that traces to an article of Regulation (EU) 2024/2847, so the same answers always give the same result, and you can show a market surveillance authority why. You supply the facts; the rules decide what they mean for the file.
Does the same evidence work for RED, the Machinery Regulation or the US Cyber Trust Mark?
Most of the evidence does; the paperwork does not. All four ask about the same engineering facts: the SBOM, the risk assessment, authentication and access control, the update mechanism, cryptography, logging, vulnerability handling and the support period. Certificates, conformity assessments and declarations stay separate, and none presumes conformity with another. Vandorisk builds the CRA technical file and Declaration today; output for the other three is on the roadmap.
CRA updates, without the noise
Deadline changes, new Commission guidance, new product capabilities. Updates are reviewed and sent by a person, and nothing is sent automatically.
What we keep: your email address and the page you left it on, as a confidential record. We use it for those updates and to follow up about Vandorisk. It is kept for up to 24 months after your last message, then deleted. We do not sell it and we do not share it for advertising. To see what we keep, correct it or have it deleted sooner, email hello@vandorisk.com.