Does the CRA apply to your product?

Generally no. A service running entirely on your own infrastructure is not a product with digital elements. If you ship client software, an app, an agent or a connector, those installed parts can fall in scope on their own. The check asks what your customers actually receive, because that is where the line sits.

The hinge is monetisation, not licence. Article 3(48) defines free and open-source software; the test for whether it is made available on the market sits in recitals 15 and 18, read with the definition in Article 3(22). Cybiq quotes those recitals rather than pointing at an article that does not carry the test.

Importers and distributors have verification and due-care duties under the CRA. The check asks for your supply-chain role and returns the articles that attach to it.

That is one of the questions. Cybiq asks about overlapping EU regimes and cites the text that matches your answer; it does not decide the carve-out for you.

Article 32(1) to (5) sets the procedures: module A, B+C, H, or a European cybersecurity certification scheme. Which of them is open to you depends on your product category; the rules for Class I, Class II and the Annex IV products differ. The check names the route that follows from your answers.

A verdict on scope, the conformity route your answers point to, the obligations that come with it, the dates, and a citation under each one. You get a permalink you can send to a colleague. No signup and no card.

A verification checklist for importers and distributors, delivered as a document you complete yourself. It follows the verdict of the free check for your role.

It is the manufacturer set: classification memo, vulnerability-handling procedure, awareness-timestamp log, four Art. 14 notification templates each printing ENISA's platform fields and character limits, Art. 14(7) and Art. 16(1) routing section, SBOM policy, secure-by-default checklist, support-period statement, Annex V declaration index, Annex VII technical documentation index, a cybersecurity risk assessment worksheet, an Annex I requirements matrix, a reporting process worksheet, a coordinated vulnerability disclosure policy template with a security.txt example and a conformity-assessment readiness guide. They are templates you complete with your own product facts; Cybiq never files anything for you.

No. The packs are templates and indexes you complete. Cybiq never files or transmits anything for you, and it does not sign anything. Where the regulation leaves a judgment to you or to your lawyer, the documents say so rather than filling in a guess.

The co-branding licence is EUR 490 per 90 days for one agency name, with no report limit, arranged by email and invoice rather than card checkout. It puts your name on the documents you generate here. The Cybiq attribution, the citations and the disclaimer stay exactly as they are.

Full application is 11 December 2027. The Article 14 reporting duties, which fall on manufacturers, have applied since 11 September 2026 and reach in-scope products already on the market. The Chapter IV notified-body framework has applied since 11 June 2026 and puts no duties on you.

For an actively exploited vulnerability, Article 14(2)(a), (b) and (c) sets an early warning within 24 hours, a notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available. For a severe incident, Article 14(4)(a), (b) and (c) sets the same 24-hour and 72-hour steps with a final report within one month after the incident notification is submitted.

To the CSIRT designated as coordinator and to ENISA simultaneously, through the single reporting platform, under Article 14(1), (3) and (7) and Article 16. On 11 September 2026, the day the Article 14 duties began, ENISA announced that it "has deployed the initial operating capability of the Single Reporting Platform (SRP)". Check the current state of the platform with ENISA before you rely on it for a specific notification.

Yes, once the CRA fully applies on 11 December 2027. Article 30(1) requires the CE marking to be affixed visibly, legibly and indelibly, and for a product in the form of software it goes either on the EU declaration of conformity under Article 28 or on the website accompanying the software product. The compliance pack carries the Annex V declaration index.

Article 13(8) sets at least five years, or the expected use time if shorter. The period is declared, and security updates run through it.

A machine-readable inventory of what your product is made of. Annex I Part II point 1 requires one in a commonly used, machine-readable format covering at least the top-level dependencies. The compliance pack has the policy; generating the file is a job for your build pipeline, not for us.

From the Official Journal text of Regulation (EU) 2024/2847, CELEX 32024R2847. Our corpus is re-verified weekly by automated tests against the live text fetched from the Publications Office CELLAR endpoint. If a quotation drifts from the source, the test flags it.

No. It is orientation grounded in the Official Journal, with a verbatim citation on every item so you can verify it yourself. For a binding assessment, take it to a qualified lawyer. Cybiq gives you the text and the structure; the judgment stays yours.

Your wizard answers stay in your browser, in the page link only. We don't keep them. Our server keeps access logs (IP address, time, page) for 30 days. The site runs on Hetzner servers in Germany. Analytics are self-hosted. Card details never reach us; Stripe handles payment.

Article 64 sets the brackets member states work within, each stated as a euro figure or a share of total worldwide annual turnover for the preceding financial year, whichever is higher: up to EUR 15 million or 2.5 percent for the essential requirements in Annex I and the obligations in Articles 13 and 14, up to EUR 10 million or 2 percent for the other economic-operator obligations, which include the EU declaration of conformity, CE marking, technical documentation and conformity assessment as well as the importer and distributor duties, and up to EUR 5 million or 1 percent for supplying incorrect, incomplete or misleading information to a notified body or a market surveillance authority. That is the shape of the bracket, not a prediction about you. Under Article 64(10) (as corrected by the corrigendum published in OJ L 2025/90555 of 2 July 2025), the administrative fines in paragraphs 2 to 9 do not apply to manufacturers that are micro or small enterprises for missing the 24-hour early-warning deadline in Article 14(2)(a) or 14(4)(a), nor to open-source software stewards.