CVD Portal

Free CRA tool

EU CRA Readiness Assessment (EN 40000-1-2)

The EU CRA Readiness Assessment checks CRA applicability with four scope gates, then rates a product against the 19 activities of EN 40000-1-2 to show which technical-file evidence exists. The tool is free and needs no signup.

Which tool is this. This checks whether you hold the evidence that EN 40000-1-2 describes, across its 19 activities. To rate how mature your practices are instead, use the ENISA maturity assessment. To find your product class and conformity route, use the classifier.

Key takeaways

  • Four scope gates decide CRA applicability before any readiness work.
  • 19 activities, 9 for risk management (Clause 6) and 10 for the lifecycle (Clause 7).
  • Each gap links to the paid feature that produces and holds the evidence.
  • On the current CEN record, EN 40000-1-2 brings no presumption of conformity.
Applicability
0 / 4 gatesIncomplete
Readiness
—0 / 19 evidenced

1.Applicability

0 / 4
1.Is it a product with digital elements?

Does the product include software, firmware, or digital or electronic hardware, or does it depend on a remote data processing solution you are responsible for?

2.Is it made available on the EU market?

Is the product supplied for distribution or use on the Union market in the course of a commercial activity, whether for payment or free of charge?

3.Does it connect to a device or network?

Does the intended purpose or reasonably foreseeable use include a direct or indirect logical or physical data connection to a device or network?

4.Does any categorical exclusion apply?

Is the product covered by a CRA exclusion, for example medical devices, in vitro diagnostics, civil aviation, marine equipment, motor vehicles, national security or defence, or spare parts replacing identical components?

Incomplete

Answer every gate to get an applicability verdict.

Scope rules in CRA Articles 2, 3 and 69

Questions

What is the EU CRA Readiness Assessment against EN 40000-1-2?

It is a free browser tool that first tests whether the Cyber Resilience Act applies to a product through four scope gates, then rates the product against the 19 normative activities of FprEN 40000-1-2, the horizontal European standard that CEN and CENELEC drafted under the CRA standardisation request M/606. For each activity it records whether the required output, the evidence a manufacturer keeps in the technical file, already exists. It returns a readiness percentage, a per-clause breakdown and a prioritised gap list.

How is this different from the SME maturity assessment?

The maturity assessment rates how mature product-security practices are on a five-level scale against ENISA's model. This tool checks, activity by activity, whether the evidence that EN 40000-1-2 describes exists. Use the maturity assessment to gauge practice quality. Use this tool to see which technical-file evidence you hold and which you still need.

How is the readiness score calculated?

Each of the 19 activities is rated as evidence exists (assessed), evidence exists (not yet assessed), partial, missing, not applicable, or unknown. Activities marked not applicable are excluded from the total. The readiness percentage is the share of applicable activities where evidence exists, shown overall and split across the risk management activities of Clause 6 and the lifecycle activities of Clause 7.

Does EN 40000-1-2 give a presumption of conformity yet?

No. FprEN 40000-1-2 closed its CEN Formal Vote on 1 October 2026, and CEN gives 18 November 2026 as its availability date. It is not cited in the Official Journal of the European Union, and the CEN project record marks it as "no citation expected" under the CRA (checked 2026-10-27). On that record, its publication as an EN brings no presumption of conformity under Article 27. Structuring the technical file to it is still useful preparation, and this tool is not a conformity determination.

CEN project record for EN 40000-1-2

Is my data stored?

No. The assessment runs entirely in your browser. Your answers are saved to your own browser's local storage so you can return to them, and nothing is sent to or stored on our servers. Use Copy summary or Print / PDF to keep a record.

Based on FprEN 40000-1-2 (CEN project record), the horizontal cybersecurity standard drafted under the standardisation request M/606 to support Regulation (EU) 2024/2847. Definitions are drawn from the CRA and the Commission FAQ on CRA implementation. This is an independent browser tool provided for guidance only. It does not constitute legal advice or a determination of CRA conformity.