Question 1 01 Under the PARTNER wholesale billing model, who pays CVD Portal?
The client pays CVD Portal directly at the standard plan price The partner pays on a wholesale subscription and bills the client themselves Payment is split evenly between the partner and the client each month Nobody is charged until the client files its first Declaration of Conformity
Question 2 02 What conformity involvement does an Annex III Class II product always require?
Self-assessment by the manufacturer working alone A third party, such as a notified body No assessment of any kind before 2030 Only a self-declaration published on the manufacturer's own website with no further steps
Question 3 03 What is the first Article 14 deadline after a manufacturer becomes aware of active exploitation?
A complete technical report due within 30 days A public press release within 12 hours Nothing is due until a fix has been shipped An early warning within 24 hours
Question 4 04 A prospect asks whether the CRA applies to them, since they are based outside the EU. What is the correct guidance?
The CRA applies only to manufacturers established inside the EU The CRA applies if their product with digital elements is placed on the EU market, wherever they are based The CRA applies only once they open an EU office The CRA never reaches a non-EU manufacturer as long as they sell through an EU-based distributor who contractually takes on all of the compliance responsibility
Question 5 05 One replacement part uses a different chipset but the same protocols and security mechanisms. Another has a different cryptographic implementation and an updated secure boot mechanism. Which counts as identical?
Neither, since a change of chipset or of implementation both defeat the exemption Both, because each keeps the same function and the same interfaces to the host product The second, because a newer secure boot mechanism is an improvement to the product's security The first, because identical is judged on cybersecurity properties rather than on the underlying components
Question 6 06 In 2028 a digital communication module fails in two connected controllers, one placed on the market in 2026 and one in 2028. The manufacturer supplies an identical replacement module for each. What applies?
The 2028 controller's spare part is in scope, while the 2026 one is grandfathered out Both spare parts are products with digital elements in their own right and need their own conformity assessment Both replacements fall within the Article 2(6) spare part exemption, and neither repair is a substantial modification Neither repair is a substantial modification, but each spare part still needs a CE mark before it can be supplied
Question 7 07 A consultant uploads a 20-file batch of mixed datasheets and manuals, then leaves the office. What happens when the batch finishes reading?
The documents are dispatched automatically once reading completes The partner admins get an email deep-linking to a mobile confirm page The batch is discarded if the partner does not return within the hour Nothing happens until the consultant reopens the console on a laptop
Question 8 08 How are the two parts of Annex I divided?
Part I is paperwork and Part II is marketing material Part I is product security by design and Part II is vulnerability handling after market Part I applies only to hardware and Part II only to software Part I is optional guidance while Part II is the one binding section for manufacturers
Question 9 09 Which prospect is the BEST fit for a partner engagement?
A large manufacturer with a full in-house compliance team already in place A company whose products never reach the EU market A firm already fully certified against the CRA An SME making EU-market connected products with no disclosure process yet
Question 10 10 A client is uneasy about seeing a third-party software line on their invoice. Which billing model best addresses that, and why?
Wholesale, because the platform cost is bundled into one price the partner charges Client-direct, because the client then sees the full platform price itemised Wholesale, because it removes the Declaration of Conformity fee from the invoice Neither, since every invoice must itemise third-party software separately
Question 11 11 Publisher A sells a paid edition of its free operating system that bundles technical assistance. Publisher B gives away a command line tool and separately offers optional paid training and installation consultancy. Who is placing software on the market?
Both, because both earn revenue that depends on the existence of the software Neither, since support and consultancy are services rather than software Only publisher B, because consultancy is priced per engagement while a paid edition is a licence fee Only publisher A, whose paid edition bundles the support into the product
Question 12 12 A design firm builds a connected device for a manufacturer and wants to hand over a working CRA compliance workspace with it. Which partner capability matters MOST to them?
Portfolio-wide read-only access to evidence across every client at once Fast client provisioning so the workspace is ready when the device ships A single consolidated invoice covering all of their operated clients Aggregated cross-client alerting for day-to-day vulnerability handling
Question 13 13 A free and open-source fitness app can only be used if the user accepts processing of their personal data for targeted advertising and unrelated analytics. Is the supply commercial?
Yes, because use is conditional on data processing unrelated to security, compatibility or interoperability No, since no money changes hands between the publisher and the user No, because personal data processing is governed by the GDPR rather than the CRA Only if the publisher can be shown to have actually sold the resulting advertising inventory to a third party
Question 14 14 What does an open-source software steward have to do under Article 24?
Run the full conformity assessment, compile the technical file, and affix a CE mark exactly as a product manufacturer does Keep a documented cybersecurity policy, cooperate with authorities, and report under Article 14(1) Nothing at all, since stewards are entirely exempt from every CRA duty Register every downstream user of the software with a national authority each year
Question 15 15 What does the cross-client review queue present?
Every document ever uploaded across all clients, in raw upload order Only the single client with the nearest deadline Work from every operated client, ranked by what is blocking whom A billing summary for each client with the amounts currently due to the partner