Frequently asked questions.

Legal questions

We are not lawyers and give no legal advice. Whether the CRA applies to your product, your role, the product's class and the conformity route are legal conclusions: we take your own view of them as our starting point. For a legal opinion, we recommend an independent law firm, which you instruct and pay directly.

What we do not do

• Write your technical documentation. We review it; the one exception is the retainer's risk-assessment update, which you approve.
• Draw up or sign your EU declaration of conformity. That stays with the manufacturer (Articles 13(12) and 28).
• Give legal advice.
• Issue certificates or act as a notified body.

Questions

Do you write our technical documentation?

No. We review it against the essential requirements and show you what it does and does not cover; the one exception is the retainer's risk-assessment update, which you approve. The documentation stays yours, and so does the EU declaration of conformity.

Will you tell us whether the CRA applies to our product?

No. That is a legal conclusion. We take your own view as our starting point. The free self-check sets out the questions and the articles, and for a legal opinion we recommend an independent law firm.

What does it cost?

Each engagement has a fixed scope and a fixed price, quoted per product. Tell us about your product and we reply in writing within two working days.

Can you help with the 24-hour reporting?

Yes. Under the retainer we assess the technical evidence of exploitation and prepare the early warning, the notification and the final report for your decision and sign-off. These reporting duties have applied since 11 September 2026 (Articles 14 and 71(2)).

Can we start with the penetration test?

Yes. Each step stands on its own.

Who does the work?

An offensive-security specialist with recognised certifications (CPTS, CRTO and CRTE) and a record of coordinated vulnerability disclosure. An AI-assisted scanner supports discovery; every finding is verified by hand.