Question 1 01 Which product sits in Annex IV, the critical tier?
A hardware security module A consumer router for home use An internet-connected children's toy A password manager application for individuals
Question 2 02 When does the CRA Article 14 reporting duty begin?
11 December 2027 1 January 2025 11 September 2026 It has no fixed start date
Question 3 03 A manufacturer signs up through a link of the form /p/ followed by a partner's slug. What happens?
They are logged straight into that partner's own tenant They land on the client's public disclosure portal with no account created They see the partner's brand and their new account is linked to that partner They receive a one-time discount on their first invoice but no other connection to the partner is recorded
Question 4 04 In 2028 a digital communication module fails in two connected controllers, one placed on the market in 2026 and one in 2028. The manufacturer supplies an identical replacement module for each. What applies?
The 2028 controller's spare part is in scope, while the 2026 one is grandfathered out Both spare parts are products with digital elements in their own right and need their own conformity assessment Both replacements fall within the Article 2(6) spare part exemption, and neither repair is a substantial modification Neither repair is a substantial modification, but each spare part still needs a CE mark before it can be supplied
Question 5 05 How does a partner operator sign in to the partner console?
As the admin of the partner's own CVD Portal tenant With a dedicated partner-only login separate from any tenant account By signing in to one of the client tenants they operate Only through the phone-sized confirm pages linked from notification emails
Question 6 06 How does document grouping work in bulk intake?
The system groups documents fully automatically and dispatches them with no partner step Documents are grouped only by the date and time they were uploaded to the batch The partner must group every document by hand with no suggestions from the system The system suggests groups by product and the partner confirms or adjusts them
Question 7 07 Which prospect is the BEST fit for a partner engagement?
A large manufacturer with a full in-house compliance team already in place A company whose products never reach the EU market A firm already fully certified against the CRA An SME making EU-market connected products with no disclosure process yet
Question 8 08 A client is uneasy about seeing a third-party software line on their invoice. Which billing model best addresses that, and why?
Wholesale, because the platform cost is bundled into one price the partner charges Client-direct, because the client then sees the full platform price itemised Wholesale, because it removes the Declaration of Conformity fee from the invoice Neither, since every invoice must itemise third-party software separately
Question 9 09 A vendor first supplies version 1.0.0 of its software on 1 January. One customer buys that day and another buys on 15 January. When was the copy bought on 15 January placed on the market?
On 15 January, since placing on the market follows each individual supply to a customer On neither date, because software is placed on the market only when its support period is declared On 1 January, the day that version was first supplied for distribution On 15 January, but only where the vendor issued no interim release between the two dates
Question 10 10 A client asks which deadline the CRA sets for acknowledging a vulnerability report to its reporter. What is the correct answer?
24 hours, the same clock as an Article 14 early warning The regulation sets none. The 48-hour acknowledgment is a CVD Portal SLA default 72 hours, matching the Article 14 notification step Article 13 sets a statutory 48-hour acknowledgment deadline that every manufacturer in the Union must meet
Question 11 11 One update adds a remember-me feature storing authentication tokens locally. Another adds diagnostics logging that writes sensitive operational data unencrypted. Neither was in the risk assessment. What is the BEST reading?
Both are substantial modifications, because each introduces unassessed risk touching the essential requirements Neither is, because convenience features and diagnostics are minor compared with the product's main functions Only the logging change is, because token storage is a standard pattern in every modern application Only the remember-me feature is, because authentication is an essential requirement while logging is a support function
Question 12 12 What does an open-source software steward have to do under Article 24?
Run the full conformity assessment, compile the technical file, and affix a CE mark exactly as a product manufacturer does Keep a documented cybersecurity policy, cooperate with authorities, and report under Article 14(1) Nothing at all, since stewards are entirely exempt from every CRA duty Register every downstream user of the software with a national authority each year
Question 13 13 When is the Article 14 final report on an exploited vulnerability due?
Immediately, alongside the 24-hour early warning Never, because the 72-hour notification is the last required step Within 14 days of a corrective measure becoming available Within six months of the vulnerability first being discovered by anyone at all
Question 14 14 A client's compliance officer asks how they can tell which of a consultant's changes were made by the consultant and not by their own staff. What makes this possible?
The consultant works under a real, attributed seat, so the client's audit log records the change under the consultant's name The client must ask the partner to email a summary of the consultant's activity each week Nothing distinguishes them, because a consultant always operates using the client's own shared identity the whole time they are working inside that client's workspace Only actions taken from the partner console, not inside the workspace, are attributed
Question 15 15 An integrator does not publish a free and open-source tool, but installs it on a customer's own server for a fee, without substantially modifying it. What is the integrator's position?
It becomes the manufacturer of that software for the customer's deployment It is not placing that software on the market It becomes the steward of the software for as long as the customer runs it It is placing the software on the market, because the installation was paid for by the customer