FREE CRA GAP CHECK
What are your gaps against the Cyber Resilience Act?
Nine questions about one product. You get a list of gaps under the CRA (Regulation (EU) 2024/2847), each with its legal basis and when it is due, and your answers stay in your browser.
For manufacturers. Not sure the CRA applies? Take the scope check first.
Common questions
What is a CRA gap check?
A short self-assessment for manufacturers of products with digital elements. Nine questions cover eight duties under the Cyber Resilience Act (Regulation (EU) 2024/2847), from 24-hour vulnerability reporting to the support period. The result lists each gap with its legal basis and when it is due.
Which CRA requirements already apply?
Reporting. Since 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours (Art. 14). This also covers products placed on the market before 11 December 2027 (Art. 69(3)).
Do the full requirements apply to a product that is already on the market?
Not automatically. The full requirements apply to products placed on the market from 11 December 2027. A product placed earlier is covered only if it is substantially modified from that date (Art. 69(2)). Reporting applies either way.
What does the gap check leave out?
It covers eight areas, not the whole CRA. The other essential requirements of Annex I, the technical documentation, the conformity assessment and the CE marking are outside it. It also takes your answers as declarations and does not check evidence.
Does this check store my answers?
No. The check runs in your browser. Your answers are not sent to a server and are not saved. If you open the contact form from your result, a one-line summary is placed in the message field, and you can edit or delete it before you send the form. We only count anonymous events such as starting or finishing the check, without your answers or your result.