When do you need a lawyer for Cyber Resilience Act compliance?
A lawyer is needed when a CRA decision carries legal risk, such as a disputed product classification, an Article 14 call on active exploitation, a delayed disclosure, or the liability behind the declaration of conformity.
Key takeaways
- Admission to the bar is the credential, and experience with EU product regulation matters more than data protection experience alone.
- Article 14 sets a 24-hour deadline for an early warning, so a lawyer for that question must answer within hours.
- The manufacturer signs the EU declaration of conformity, and legal advice does not move that responsibility to the lawyer.
- A written opinion on one specific question costs less than a retainer and is easier to compare between firms.
Last reviewed 17 October 2026
Published by Porta Regulus B.V. No paid placement. No provider is named or ranked.
Which CRA requirements does this service give evidence for?
- Article 32 conformity route, when the product classification is disputed
- Article 14 reporting, when active exploitation is unclear
- , a justified delay of public disclosure
- , legal safe harbour wording in the disclosure policy
- EU declaration of conformity, the liability the manufacturer accepts
Which credentials should the provider hold?
The only credential is admission to the bar in an EU member state. Check it in the national bar register. Many bar rules restrict paying fees for referrals, so a directory that lists a lawyer should take no referral fee.
What should you ask the provider for?
- A written opinion on a named question, at a fixed fee.
- Experience with EU product regulation under the New Legislative Framework.
- A response time for Article 14 questions, stated in hours.
- A conflict check against your competitors and your suppliers.
Which red flags should stop the hire?
- A generic "CRA compliance package" with no specific question answered.
- No experience with product regulation, only data protection.
- No way to reach the lawyer inside the Article 14 24-hour window.
Which checks apply to every CRA expert?
- Professional liability insurance that covers the work, with the amount in writing.
- Independence from your own developers and from any supplier whose component is in scope.
- A fixed price for a written scope with a defined end.
- Names and credentials of each person who does the work.
- A deliverable you may share with a notified body and a market surveillance authority.
- Data handling inside the EU, or a written basis for any transfer.
Find out which of these services your product needs
CVD Portal lists the open Annex I gaps for each product and names the kind of expert that closes each one.
This page is part of the EU Cyber Resilience Act guide, which explains Regulation (EU) 2024/2847 article by article.