Start with a CRA Dossier or training
Choose this route when your team needs to understand a particular CRA requirement before deciding whether further support is necessary.
Explore CRA resourcesLoading the latest actively exploited vulnerabilities…Powered by Achilles
CRA Consultancy
Cyber Resilience Act Consultancy
Turn CRA requirements into a practical, product-specific compliance plan.
Understand how the Cyber Resilience Act applies to your products, identify gaps and establish clear priorities, responsibilities and evidence requirements.
Thank you
We have your question and will be in touch within two working days.
Comply.Land provides Cyber Resilience Act consultancy for manufacturers of products with digital elements, including software, connected devices, Internet of Things (IoT) products and products incorporating third-party digital components.
We also support importers, distributors, commercial open-source businesses and manufacturers based outside the European Union that are preparing to place products on the EU market. Whether you already have an established presence in the EU, work with an Authorised Representative or are still considering the most appropriate route, we can help you understand your options and responsibilities.
Learn more about our EU Authorised Representative service
Our specialists connect CRA requirements with your product-development processes, vulnerability-management procedures, software supply chain, technical documentation and route to conformity.
Define your CRA route before investing time in documentation, testing or processes that may not apply to your products.
Who it is for
Who is CRA consultancy for?
Comply.Land supports organisations that manufacture, import, distribute or place products with digital elements on the European Union market. This includes:
- Software, connected-product and IoT manufacturers
- Manufacturers incorporating software, remote data-processing solutions or third-party digital components into their products
- Commercial open-source businesses
- Manufacturers based outside the European Union
- Importers and distributors assessing their CRA responsibilities
- Organisations managing one product, a product family or a wider portfolio
Services
What can we help you with?
01
CRA scope and organisational role
Clarify whether the CRA applies to the relevant products and identify whether the organisation acts as a manufacturer, importer, distributor or another economic operator. We can also help identify relevant exclusions, dependencies and responsibilities involving suppliers, open-source components and other third parties.
02
Product classification
Assess whether a product is likely to fall within the default category or qualify as an important Class I, important Class II or critical product with digital elements. Identify the likely conformity-assessment route and the documentation and evidence the organisation may need to prepare.
03
CRA gap assessment
Compare the organisation's existing product-security processes, technical evidence and documentation with the applicable CRA requirements. Identify what is already in place, what requires improvement and what is missing.
04
Vulnerability management and reporting
Review how vulnerabilities and severe incidents affecting product security are identified, assessed, escalated, documented and reported. This can include internal responsibilities, evidence preservation, coordinated vulnerability disclosure and preparation for the CRA reporting obligations applicable since 11 September 2026.
05
Technical documentation
Support the preparation or review of documentation demonstrating how a product meets the applicable CRA requirements. This may include cybersecurity risk assessments, security requirements, development evidence, testing records, vulnerability-management procedures, support-period decisions and information provided to users.
06
Software supply chain and third-party components
Review how the organisation identifies and manages open-source software, commercial components and other digital dependencies included in its products.
07
Secure product development
Help translate applicable CRA requirements into product-development and maintenance processes, including security by design, security updates, vulnerability remediation and support throughout the product lifecycle.
08
Conformity preparation
Help the organisation understand the documentation, evidence, testing and internal decisions required for its likely conformity-assessment route. Comply.Land consultancy and expert review do not replace certification or a formal third-party conformity assessment where one is legally required.
Outputs
What can you expect to receive?
Every engagement is scoped around the products, questions and outcomes agreed with your organisation. Depending on that scope, you may receive:
Assessment of your current position
A written assessment covering the relevant products, organisational role, likely product classification and current level of CRA preparation.
Prioritised compliance plan
A practical plan identifying gaps, recommended actions, dependencies, responsibilities and priorities.
Process and evidence guidance
A structured view of the technical documentation, product-security evidence, vulnerability-management processes and reporting workflows that require development or improvement.
Conformity-preparation roadmap
An outline of the likely conformity route and the documentation, evidence, testing and internal decisions required to prepare for it.
The final deliverables are defined in the agreed scope and proposal.
Right format
Is consultancy the right starting point?
Consultancy is most useful when your organisation has complex products, an uncertain route to compliance, significant documentation gaps or questions requiring product-specific analysis.
You may not need an ongoing consultancy engagement if your team already understands the applicable requirements and can complete most of the preparation internally. Comply.Land offers several ways to obtain the level of support you need.
Bring your teams together in a workshop
A tailored workshop can help engineering, product security, compliance, legal and leadership teams understand their responsibilities, address product-specific questions and agree on practical next steps.
Plan a CRA WorkshopPrepare the documentation internally
If your organisation is ready to carry out the preparation work itself, the CRA Compliance Binder provides a structured framework for assembling the required documentation and evidence.
Comply.Land specialists review the completed package against the agreed CRA scope and identify areas requiring further work. Comply.Land's expert review is not certification or a formal conformity assessment by a notified body.
Explore the CRA Compliance BinderUse consultancy for complex or continuing support
Consultancy is appropriate when your organisation needs deeper product analysis, help resolving gaps, continuing access to specialist knowledge or support coordinating implementation across several products and teams.
Discuss CRA consultancyProcess
How a CRA consultancy engagement works
- Step 01
Initial discussion
We discuss your organisation, products, current preparation and the questions or outcomes you need to address. If consultancy is not the most appropriate starting point, we will explain which form of support may suit your current position better.
- Step 02
Scope and proposal
Comply.Land defines the proposed work, expected deliverables, required information, timing and price.
- Step 03
Assessment and support
Our specialists review the relevant products, processes and documentation and work with the appropriate members of your team.
- Step 04
Findings and next steps
You receive the agreed outputs, priorities and recommendations. Where further implementation support is required, this can be included in the proposal or agreed as a subsequent phase.
Why Comply.Land
Why work with Comply.Land?
Comply.Land combines regulatory knowledge, cybersecurity expertise, software-industry experience and direct involvement in European standardisation.
Our in-house specialists include multiple ETSI Rapporteurs contributing to the development of standards intended to translate CRA requirements into technical specifications and assessment criteria. This involvement helps us connect regulatory obligations with the practical processes, evidence and product decisions organisations need to prepare for compliance.
Meet the Comply.Land teamOther services
Other services
Not ready for consultancy? If your organisation does not yet need product-specific consultancy, you can begin with:
- A CRA Dossier or training course to understand a particular requirement
- A tailored workshop to align your teams and responsibilities
- The CRA Compliance Binder if your team intends to prepare the documentation internally and needs a structured framework and expert review
FAQ
Frequently asked questions about CRA consultancy
When should an organisation seek CRA consultancy?
Consultancy may be appropriate when an organisation is uncertain how the CRA applies to its products, needs help with product classification, has significant documentation or process gaps, or requires product-specific advice that cannot be answered through general guidance.
Does every organisation need ongoing CRA consultancy?
No. Some organisations have the internal knowledge and resources to complete much of the preparation themselves. In these cases, a Dossier, training course, workshop, focused assessment or the CRA Compliance Binder may provide a more appropriate starting point.
Can Comply.Land support more than one product?
Yes. The scope can cover one product, a product family or a wider portfolio. The proposed approach, timing and deliverables will depend on the number and complexity of the products involved.
Can you help manufacturers based outside the European Union?
Yes. Comply.Land can help manufacturers based outside the EU understand their CRA responsibilities and prepare products for the European market. Where relevant, we can also explain the possible role of an EU Authorised Representative.
Does Comply.Land provide CRA certification?
Consultancy and expert review do not constitute certification or a formal third-party conformity assessment. Where a formal third-party assessment is required, the appropriate route will depend on the product classification and applicable legal requirements.
How much does CRA consultancy cost?
The price depends on the products, questions, documentation, number of teams involved and agreed deliverables. Following the initial discussion, Comply.Land provides a proposed scope, timing and price before work begins.
Discuss your CRA consultancy requirements
Tell us about your organisation, products and current CRA questions. We will help define the appropriate scope, deliverables and next steps.