01 — SCOPE
Is this product actually in scope?
EU market exposure, manufacturer role, digital elements, connection to devices or networks, and sector-specific exclusions all matter.
EU PRODUCT COMPLIANCE ENGINEERING
Keep your connected products sellable in Europe.
Product-level CRA readiness for US manufacturers of industrial, embedded and connected products — from scope and classification to evidence, reporting and remediation planning.
No signup for QuickCheckNo confidential detailsEngineering-first
PRODUCT-LEVEL SIGNALS
Know what matters before the deadline becomes a project crisis.
EU market exposureCurrent / planned
CRA scopeProduct-specific
Reporting readiness24h / 72h process
ClassificationDefault / Important
The QuickCheck gives a preliminary signal. The paid assessment builds the defensible product-level reasoning and evidence plan behind it.
11 Sep 2026
Article 14 reporting duties are already in force.
Actively exploited vulnerabilities and severe product-security incidents can trigger 24-hour and 72-hour reporting.
11 Dec 2027
Main CRA product obligations apply.
Product cybersecurity, conformity, technical documentation and vulnerability-handling requirements become fully applicable.
THE PRODUCT QUESTIONS
CRA is not one checkbox. It changes by product.
For a US manufacturer, the practical questions are usually technical before they are administrative.
02 — CLASSIFICATION
Default, Important Class I/II, or critical?
Core functionality matters. A gateway that merely sends its own data is not the same as a product whose core function is routing, VPN or network management.
03 — EVIDENCE
Can you prove the engineering story?
Risk assessment, SBOM, vulnerability handling, update capability, support period and traceability must form a coherent product evidence base.
START WITHOUT A SALES CALL
Run the CRA QuickCheck first.
About 10–12 short questions. No signup, no source code, no confidential architecture details. The assistant adapts to the product and returns a preliminary readiness snapshot.
- Current or planned EU market exposure
- Article 14 reporting readiness
- 2027 evidence foundation
- Support-period signal
- Preliminary classification signal
CRA readiness snapshot
EU market exposureCurrent EU market
Current reporting readinessGaps identified
2027 evidence foundationPartial
Support-period signalNeeds review
Classification signalDefault plausible
SEE THE OUTPUT BEFORE YOU BUY
Concrete deliverables, not an abstract consulting promise.
Review a fictional assessment excerpt to see the structure, reasoning and level of detail you can expect, plus the field brief used for technical outreach.
Sample CRA Product Readiness Assessment
Three-page fictional excerpt: readiness snapshot, classification reasoning, gap-matrix excerpt and 90-day remediation plan.
Open sample deliverable →The Two CRA Deadlines
A nine-page field brief for US industrial manufacturers covering Article 14, the 2027 evidence stack, classification, support period and a 90-day readiness sequence.
Download the field brief →ONE PRODUCT FAMILY
CRA Product Readiness Assessment
Turn the QuickCheck signals into documented scope and classification reasoning, an Annex I evidence-gap matrix, Article 14 readiness review, support-period assessment and a prioritized 90-day remediation plan.
RR
ENGINEERING FIRST
Product compliance needs engineering judgment, not checkbox theater.
ConformVector is led by Ronald Reisener, Diplom-Informatiker (FH), with more than twenty years of work across embedded systems, technical integration, requirements-based engineering, medical technology and avionics.
From biomedical measurement and embedded development to the A400M Loadmaster Workstation / Loadmaster Control System environment and later independent systems work, the common thread is evidence: requirements, interfaces, failure modes, traceability and technically defensible decisions.
Embedded HW / SW / FWSystem integrationRequirements & traceabilityA400M avionicsMedical technology
CRA readiness is not primarily a paperwork problem. It is a product-engineering evidence problem.
WHO THIS IS FOR
Focused on physical connected products.
Good fit
- Industrial sensing and instrumentation
- Embedded controllers and industrial electronics
- Edge / IIoT gateways
- Machine vision and test equipment
- Building automation
- Robotics components
Not our starting focus
- Medical devices under MDR / IVDR
- Automotive products covered by specific vehicle rules
- Certified aviation products
- Pure SaaS with no relevant product-with-digital-elements angle
FOR LABS & CONSULTANTS
Supporting manufacturers with EU market access?
Add product-level CRA engineering to your existing testing, product-safety or advisory services. Start by discussing one anonymized client situation.
HOW IT WORKS
Start small. Escalate only where evidence requires it.
STEP 01
CRA QuickCheck
Free preliminary signal. Product-level questions, no signup.
STEP 02
Product Readiness Assessment
Fixed-scope review of one product family and its evidence base.
STEP 03
Readiness Build
Engineering and documentation work to close selected gaps. Typical implementation scopes are roughly $15k–$40k+ depending on product complexity and agreed work.
COMMON QUESTIONS
Questions US manufacturers ask first.
We do not sell directly in Europe. Can the CRA still matter?
Yes. A product can be made available on the EU market through distributors, importers, OEM routes or other channels. The actual product and economic-operator roles matter more than who owns the customer relationship.
We already have an SBOM. Is that enough?
No. An SBOM is one element of the vulnerability-handling and technical evidence foundation. Risk assessment, vulnerability processes, update/remediation capability, support period and traceability still need to line up.
Our product has VPN. Does that automatically make it Important Class I?
No. The CRA classification analysis is based on the core functionality of the product as a whole. Integrated functionality does not automatically elevate the entire product; the product-level role must be assessed.
Do you need source code for the QuickCheck?
No. The QuickCheck explicitly asks users not to submit source code, credentials, unpublished vulnerabilities or confidential architecture details.
Is this legal advice or certification?
No. ConformVector provides technical product-compliance engineering and readiness assessment. The QuickCheck is preliminary engineering triage, not a legal opinion, certification or conformity decision.
Start with one product.
If the QuickCheck surfaces something material, request a 20-minute fit call. Most assessment work is asynchronous and document-based; calls are scheduled as needed across US time zones.