CRA Product Readiness Assessment

What you get

This is not a generic CRA workshop. The assessment is centered on one defined product family and the evidence that already exists around it.

1. CRA applicability & manufacturer-role assessment

EU market route, manufacturer / OEM / importer / distributor roles, relevant exclusions and assumptions.

2. Classification reasoning

Default category vs. Important Class I/II or critical-product signals, with reasoning tied to the product’s core functionality rather than isolated features.

3. Article 14 reporting readiness

Owner, decision criteria, escalation path, 24-hour / 72-hour workflow and ENISA Single Reporting Platform readiness.

4. Annex I evidence-gap matrix

Cybersecurity risk assessment, security requirements and traceability, SBOM, vulnerability handling, update/remediation capability and related technical evidence.

5. Support-period review

Security-support commitment compared with expected operational use, including product-level reasoning where long industrial service life creates tension.

6. Prioritized 90-day remediation plan

A practical sequence of actions, owners and evidence targets. Missing evidence is treated as a finding rather than a reason to stop the assessment.

Typical inputs

Product description, variants and intended use
EU sales / distribution / OEM routes
Existing cybersecurity risk material and security requirements
SBOM or component inventory, if available
Vulnerability-management and incident-response process material
Update mechanism and security-support commitments
Selected technical documentation sufficient to establish traceability

You do not need to have everything. The absence of evidence is itself useful information for the readiness decision.

How the assessment runs

DAY 0Scope confirmation, NDA if requested, and secure intake.

DAYS 1–4Document and product evidence review; focused follow-up questions.

DAYS 5–6Classification, gap synthesis and remediation prioritization.

DAY 7Assessment package and review call, subject to timely intake and agreed scope.

US vendor onboarding

NDA before intakeMutual or customer NDA can be put in place before product evidence is shared.

USD invoicingAssessment pricing and invoices can be handled in US dollars.

IRS W-8 documentationThe appropriate W-8 documentation can be provided for US vendor onboarding.

Data-handling summaryA concise description of the QuickCheck and assessment data flow is available for security/procurement review.

ConformVector is based in Germany. The assessment is designed to be mostly asynchronous and document-based, with scheduled calls as needed across US time zones.

What it is not

The assessment is technical product-compliance engineering. It is not legal advice, a notified-body assessment, certification, a declaration of conformity, or a guarantee that a product is compliant.

What happens after

You can take the report and execute internally. If useful, ConformVector can separately scope a Readiness Build for selected engineering or documentation gaps. Typical implementation scopes are roughly $15k–$40k+, depending on product complexity and the selected work. Implementation is quoted separately after the assessment.