You sell it once.
You must update it for years.

CRA self-check

Customer pays
once
Still yours after the sale
you
Your cost per device
?

A 10-minute check on the EU Cyber Resilience Act for manufacturers with devices in the field: ten questions on reporting, update path and supplier commitments. “Don’t know” is a valid answer. At the end you see your gaps by deadline and a first estimate of the update cost per device. Your answers stay in your browser.

Prefer to talk first? Book a free 20-minute call

Built by Kai Hackbarth: in IoT since 2001, remote updates for over 4 million vehicles.

Not legal advice · not a conformity assessment

What the ten questions cover
  1. Can you securely update the firmware of the devices you ship, remotely or through an update path your customers control?
  2. Have your chip, module and OS suppliers committed to patches for your whole support period?
  3. Do you have a machine-readable software bill of materials for each release, covering at least the top-level dependencies?
  4. Can outsiders report a vulnerability to you via a published contact and policy?
  5. As of today, could you report an actively exploited vulnerability or a severe incident within 24 hours?
  6. Have you set a support period and told buyers its end date?
  7. Does every device ship without a shared default password, with its connections encrypted or, where the protocol cannot encrypt, protected another way?
  8. Are your cloud backend and app covered by the same security process as the device?
  9. Do you know what the free security updates required by the CRA cost you per device?
  10. Do you have a documented cybersecurity risk assessment for each product (not only the CE risk assessment of the machine)?

Reporting has applied since 11 September 2026, to products already sold as well; the remaining requirements apply from 11 December 2027 (Regulation (EU) 2024/2847).

No cookies · answers stay in your browser · Privacy

The page never sends or stores your answers; you can email them yourself. Our web server logs page visits, clicks on the booking link and, without your answers, that a result was shown.