| CRA Self-Assessment
DE EN

With ViaGuardium you establish whether your product falls under the Cyber Resilience Act — and which requirements then apply.

You receive a CRA assessment report: it examines whether Regulation (EU) 2024/2847 applies to your product, places it in the product classes of Annexes III and IV, and states for every essential requirement of Annex I whether it is relevant. Billed per report.

What your report contains

Not a slide deck and not a gut-feeling assessment, but a traceable document you can attach to your technical documentation, show to a customer or put in front of a notified body.

The core statement

In plain words and in a prominent place: whether your product is likely to fall under the CRA, whether it is likely not to, or whether only the reporting obligations apply. The report also discloses which criterion tipped the balance.

Product class under Annexes III and IV

The classification based on your product's core function: default product, important product class I or II, critical product. It determines which conformity assessment procedure is open to you.

Product profile and risk context

Intended purpose, reasonably foreseeable use, foreseeable misuse, hardware and software revision and the support period — the details the technical documentation requires in any case.

Interfaces assessed individually

Every outward connection — down to maintenance and diagnostic access — is recorded separately and receives its own rating of how exposed it is.

Protection needs of the data

Which data your product processes and what follows from that: personal data, sensitive data, operational and business data. Every rating stays linked to the question it came from.

Risk matrix and findings list

The risk situation per interface and asset, once as a matrix and once as a list — including the places where the two routes arrive at different results.

Essential requirements from Annex I

The relevant requirements with the implementation level expected in each case and the associated measure. The basis is BSI TR-03183-1, which spells out the requirements of Annex I.

Substantiated exclusions and methodology

Requirements that are not relevant for your product do not simply go missing — they appear in the report with their reasons. Plus the calculation method and how deviations are handled, as an auditable PDF.

Worth it from the very first product

You do not need a large product family for a report to pay off.

A single product is already enough

  • The report answers the question whether at all — and if so, with which requirements. That answer is worth just as much for one product as for thirty.
  • If the assessment indicates that your product does not fall under the regulation, you have that documented and can evidence it at any time.
  • If it does fall under it, you know the relevant requirements and can implement them in a targeted way instead of working through the whole of Annex I.

How to place the report

  • You remain the manufacturer — we supply the basis. Under the regulation, responsibility for the declaration of conformity and the technical documentation stays with you. The report is a self-assessment, not a conformity assessment.
  • No legal advice. The report says what your input suggests and discloses what it turns on. It does not replace a legal assessment of the individual case.
  • No notified body. Where the regulation requires a notified body to be involved for important or critical products, that remains necessary.
  • No presumption of conformity. BSI TR-03183-1 is an interpretation aid, not a harmonised standard, and carries no presumption of conformity under Article 27. The report states its outcome as an indication with a chain of reasoning.
  • With a reference date. The assessment applies as of the date of issue. If your product changes substantially, the assessment changes with it.

How billing works

You are billed per report — not per user and not per month.

Single assessment

To get started
On request

One report for one product, billed once.

  • Full report scope as described above
  • Any number of interfaces in the report
  • Worthwhile from a single product onwards
  • Auditable PDF, ready to use
Request terms

Assessment package

For several products
On request

Several assessments up front, with graduated terms by package size.

  • Everything from the single assessment
  • Lower cost per report the larger the package
  • For manufacturers with several products or variants
  • Assessments freely distributable across your products
Request terms

We agree the specific terms with you personally — they depend on scope and use case. All figures are exclusive of statutory VAT.

Optional: keeping an assessment current

BSI TR-03183-1 is explicitly a living document and continues to be revised. An assessment therefore states the position as of its date of issue — which is fine for a one-off report, but not for a product you keep on the market for years.

Update subscription (monthly re-assessment)

  • An existing assessment is recalculated monthly against the current version of the catalogue and configuration.
  • You see where a revised guideline changes the picture for your product — and where it does not.
  • Billed per product under assessment, alongside the report itself.

Explicitly on request only

  • The update subscription is optional and not part of the report.
  • It is set up solely upon explicit request and by arrangement — never automatically and never billed silently.
  • You can mention it in your request or ask for it at any later point.

How to get access

There is deliberately no instant access at the click of a button.

Why we review every request manually

A CRA assessment shows in black and white where a product is open to attack and which requirements are still outstanding — that is not information to hand out to anyone through an automated self-service form. So we do not provision accounts automatically; we review every request personally. It costs you a few minutes and us a follow-up question — and it keeps the results where they belong.

1

Fill in the contact form

A few details: who you are, which product this is about and how many products you want to assess. Takes about two minutes.

2

We review it personally

We look at your request and get back to you — with questions about your use case if needed. No automated dispatch, but a person.

3

Access and terms

You receive your credentials and an offer with the terms that apply to you — matched to scope and use case.

Request access

Already a customer?