Retainer capacity is full until mid-2027.Fixed-scope projects available on request.
CRA Calculator
Settle your CRA position.
The verdict names whether the Cyber Resilience Act reaches your product, the role you hold in law, and the product class that decides self-assessment against a notified body Notified body An independent organisation designated by an EU member state to assess whether a product meets the regulation's requirements. Only products in the higher CRA classes need one; most products can self-assess. .
- 6 questions
- About 2 minutes
- Free, no sign-up
Your CRA position
What you still need
Your deadlines: vulnerability reporting obligations are already in force, including for products you have shipped. From 11 December 2027 a product that does not meet the requirements cannot be placed on the EU market. What CRA readiness involves →
This is a starting point for a conversation. Product classification turns on the exact wording of the annexes and on how your product is actually used. Bring this verdict to the call and we confirm it against the product you ship.
Working out where the company should start instead? The security path calculator recommends a framework in 18 questions.