Compliance tools · Cybersecurity and data protection

Cyber Resilience Act compliance tool

Regulation (EU) 2024/2847 · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Cyber Resilience Act documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Cyber Resilience Act is Regulation (EU) 2024/2847, a binding instrument in the European Union. Security requirements for products with digital elements placed on the EU market.

The free assessment screens for Cyber Resilience Act when a business makes or supplies products with digital elements.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Cyber Resilience Act: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Cyber Resilience Act applies to your business, free →

Does Cyber Resilience Act apply to my business?

The Cyber Resilience Act applies to you if you place products with digital elements on the EU market as a manufacturer, importer, distributor or other economic operator (Article 3(12)). It also reaches open-source software stewards (Recital 19). If you do none of these things, it does not apply to you.

Who does Cyber Resilience Act apply to?

It applies to manufacturers (Article 3(13)), importers (Article 3(16)), distributors (Article 3(17)), authorised representatives (Article 3(15)) and open-source software stewards (Recital 19). These are the economic operators in the supply chain of products with digital elements placed on the Union market.

Does Cyber Resilience Act apply to a small business?

There is no size threshold and no size exemption from the CRA itself. Microenterprises, small and medium-sized enterprises are expressly within scope (Recital 19), though microenterprises and small enterprises may use a simplified technical documentation form (Article 33(5)) and are exempt from fines for missing the 24-hour early warning deadline (Recitals 120-122).

When does Cyber Resilience Act apply from, and what are the deadlines?

The CRA applies in full from 11 December 2027. Reporting obligations under Article 14 start earlier, on 11 September 2026, and the provisions on notification of conformity assessment bodies apply from 11 June 2026. The Commission must adopt the product category technical description implementing act by 11 December 2025 (Article 7(4)).

What does Cyber Resilience Act require me to do?

As a manufacturer you must design and produce products to the essential cybersecurity requirements in Part I of Annex I (Article 13(1)), run a cybersecurity risk assessment (Article 13(2)), draw up technical documentation (Article 13(12)), handle vulnerabilities for the support period (Article 13(8)) and affix the CE marking after conformity assessment (Article 13(12)). Importers and distributors have their own verification duties under Articles 19 and 20.

What records or documents does Cyber Resilience Act require me to keep or produce?

You must keep technical documentation per Annex VII, retained for 10 years or the support period, whichever is longer. You must be able to present supply chain identification information for 10 years after being supplied and 10 years after supplying a product (Article 23(2)). Authorised representatives must keep the EU declaration of conformity and technical documentation for at least 10 years or the support period (Article 18(3)).

What happens if I do not comply with Cyber Resilience Act?

Member States must lay down penalties (Article 64(1)). Maximum administrative fines reach EUR 15,000,000 or 2.5 per cent of worldwide annual turnover for breaching the Annex I essential requirements, EUR 10,000,000 or 2 per cent for other manufacturer obligations, and EUR 5,000,000 or 1 per cent for incorrect, incomplete or misleading information (Article 64, Recital 120).

Does Cyber Resilience Act apply to a UK business selling into the EU?

The CRA applies to the European Union internal market, and that products with digital elements must meet the essential cybersecurity requirements when placed on or made available on the Union market (Article 6). The instrument does not state this about a UK business selling into the EU.

How do I start complying with Cyber Resilience Act?

Start by determining whether your product falls in scope and which category it sits in, default, important class I, important class II or critical, since that choice drives the conformity assessment route (Article 32). The toolkit starts with scope and product classification.

Which ComplianceSME account includes the Cyber Resilience Act toolkit?

The Cyber Resilience Act agent toolkit is included from the Medium level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive