Regulation (EU) 2024/2847 — the Cyber Resilience Act
Find out what the CRA actually requires of your product.
Nine questions, a dated answer, and the Article behind every claim. Free, no account, no email. Then, if you want it, the paperwork built from the same answers.
Check my product Read the facts first
Takes about a minute. You get a permanent link you can send to a customer who asked.
11 September 2026
Reporting starts
An actively exploited vulnerability in your product, or a severe incident affecting its security, must be reported — early warning within 24 hours of becoming aware.
in 3 days
11 December 2027
Full application
Technical documentation, the EU Declaration of Conformity and CE marking, before the product goes on the EU market.
in 15 months
These are two clocks, not one. A product already on the market has reporting duties now and needs CE marking only on substantial modification. Most summaries collapse them and tell you that you are safe until 2027. The checker keeps them apart.
Who this is for
You ship software or a device into the EU
An app, a plugin, an SDK, firmware, a connected device. You are the manufacturer, whether or not you have ever thought of yourself that way.
A customer sent you a questionnaire
Procurement asked for your CRA position, an SBOM and a disclosure policy, with a deadline. That form is the reason most people arrive here.
You are one to twenty people
Nobody on staff owns compliance. A consultant quotes five figures. The Regulation does not care about your headcount.
What the checker tells you
Scope, and why
In, out, conditional, or the lighter open-source regime — with the Article that decides it, not a verdict you have to take on trust.
Your role
Manufacturer, importer, distributor or open-source steward. The obligations are materially different and people routinely assume the wrong one.
Your class
Default, important class I or II, or critical, with the Annex III or IV item that matched. This decides whether you can self-assess at all.
Both dates, separately
When Article 14 reporting starts for you, and when — or whether — CE marking is required. Never merged into one answer.
Your backend, if it counts
Remote data processing your product cannot work without is part of the product. The checker says so when it applies to you.
A link you can send
Every result is a permanent public page with your answers, the reasoning, and the version of the law it was decided under.
Then the paperwork, from the same answers
The checker is the free part and it stays free. What costs money is everything after it: the documents, and the process that keeps them true.
Attestation Pack
$149 one-time, per product
The answer to the supplier questionnaire on your desk.
Tell me when this shipsNot built yetProduct plan
From $49 per month, banded by how many products you run
The running process the Regulation actually asks for.
Tell me when this shipsNot built yetAgency
$299 per month, 10 products, then $15 each
For people carrying this for other people's products.
Tell me when this shipsNot built yetWhy you should believe any of this
Every claim carries its Article
The legal content is a versioned table of facts, each with its citation. Pages and verdicts reference facts by id, so a sentence that makes a dated or obligation-bearing claim without a citation fails the build and cannot be served at all.
You can read the whole thing
The entire Facts Table is public JSON, and the status page says what is settled and what is not — including the parts nobody knows yet, like whether harmonised standards will arrive in time.
CEMarque does not certify anything
Nobody can sell you a CE marking. CEMarque prepares documentation; you declare conformity and you sign it. If your product needs a notified body, the checker tells you that and sells you nothing.
It is not legal advice, and it says so
On every page and every export. The point is to get you a defensible first answer and the citations to check it — cheaply enough that you actually do it.
Start with the question that decides everything else
Whether the Regulation applies to your product, and which clock you are on.
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 3 September 2026 (Facts v2026.09.2). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.