Your Cyber Resilience Act file, drafted from your repository, on your machine.
Regulation (EU) 2024/2847 applies to software and hardware products sold in the EU, including from outside the EU. The generator reads your repo and drafts the Annex VII technical file, a CycloneDX SBOM, the risk assessment, the disclosure policy, the user information, the support period note, an unsigned EU declaration of conformity and a gap list with file-and-line evidence. Every statement names its article. Your code stays with you.
Everything here is a draft for the manufacturer to review, complete and sign. It is not legal advice, and no document produced here claims that a product conforms to the regulation or carries the CE marking.
Free scope check
Eight questions, no signup. The answer applies the regulation text and Commission Implementing Regulation (EU) 2025/2392 (the technical descriptions of important and critical product categories) and cites the article, annex or recital for each reason.
What the generator produces
Thirteen documents plus the SBOM, written in the structure the regulation asks for. The two samples show the real output, gaps included.
- Scope and classification Articles 2, 3, 7, 8, 32, 69, 71; Annexes III and IV; Implementing Regulation (EU) 2025/2392
- Technical documentation in the Annex VII structure Article 31
- Cybersecurity risk assessment skeleton, one entry per Annex I Part I requirement Article 13(2) to (4)
- Vulnerability handling: procedure, coordinated disclosure policy draft, security.txt, Article 14 reporting playbook with the 24-hour, 72-hour, 14-day and one-month deadlines Annex I Part II, Articles 13(6) to (9), 14
- Information and instructions to the user Annex II, Article 13(16) to (20)
- Support period note with the factors the regulation lists Article 13(8), 13(9), 13(19)
- EU declaration of conformity, unsigned draft with the simplified form Article 28, Annexes V and VI
- Gap list: every requirement with a status (evidence found, partly shown, not found, manufacturer decision, not applicable), the file and line that shows it, the action left and its source
- SBOM in CycloneDX JSON through an established tool (cdxgen; cyclonedx-npm and cyclonedx-bom as fallbacks) and a known-vulnerability report from osv.dev, split into shipped and build-time components Annex I Part II point (1), Annex VII point 8
- dossier.json for the per-release refresh: version, SBOM hash, vulnerability counts, statuses
How it runs
- Run it locally. A Claude Code skill or a plain Node CLI (Node 18 or later, no dependencies). The only network call is the optional OSV query of package names and versions;
--no-vulnsturns it off. - Fill the human answers. One answers file: manufacturer identity, intended purpose, support period, contacts. With Claude Code the skill drafts the prose from your repository and cites the files it relied on; you decide the rest.
- Close the gaps and sign. The gap list tells you what is open and which article asks for it. The declaration stays an unsigned draft until you sign it.
- Keep it current. A GitHub Action re-issues the dossier on every release tag, regenerates the SBOM, re-checks known vulnerabilities and fails the build when the declaration no longer matches the shipped version (Article 31(2), Article 28(2)).
Two real dossiers, gaps and all
The publisher's own Android apps, both monetised and sold to EU users through the Solana dApp Store, so both are in scope as default products. Published as generated.
Seeker Scout
Companion app for the Solana Seeker dApp Store, version 0.11.0. 803 SBOM components, 63 items in the gap list, 57 open.
Open the dossierCOOK
Meme character and coin launcher for the Solana Seeker, version 2.0.0. 814 SBOM components, 63 items in the gap list, 57 open.
Open the dossier57 open items on a shipping indie app is the honest baseline. The value of the file is that each open item is named, sourced and actionable.
Pricing
Paid once per product through Paddle (merchant of record, EU VAT invoices). Delivery: the download link for the skill and CLI appears on the confirmation page and in your receipt. Written support by email.
Dossier
- Skill + CLI licence for one product
- All documents and the SBOM
- Automated gap list with evidence
- Re-run as often as you like
Dossier + reviewed gap list
- Everything in Dossier
- Your generated gap list reviewed by a person, item by item, against your repository, with the Annex I reference and the fix for each
- Delivered in writing within 5 business days
Keep-current
- Re-issue on every release through the GitHub Action
- SBOM regenerated, known vulnerabilities re-checked weekly
- Build fails when the declaration is stale
- Generator updates as the implementing acts and guidance change
Agency
- Skill + CLI for client work
- Keep-current for every covered product
- Written onboarding notes for your team
What the free tools do not do
Free declaration-of-conformity generators and template packs exist, and GitHub exports an SPDX SBOM. What they do not do: read your repository and draft the Annex VII prose from it, produce a gap list with file-and-line evidence per requirement, or re-issue the whole set on every release. That is what you pay for here. If a template is all you need, use one.
Keep-current waitlist
If you would rather wait for the per-release subscription to settle before paying, leave an email and we write once when the GitHub Action and the refresh cadence are final. No other mail.
Questions
Is this legal advice or a certification?
No. The generator drafts technical documentation from your repository and cites the regulation. A lawyer, a notified body or a certification scheme is a separate decision. Under Article 28(4) the manufacturer assumes responsibility by drawing up the declaration; the tool does not and cannot.
Does my code leave my machine?
No. The scan, the SBOM and the rendering run locally. The optional vulnerability check sends package names and versions to osv.dev; nothing else goes anywhere. For the $299 review you send the generated folder, not the code.
I am outside the EU. Does the CRA apply to me?
Yes, when your product is placed on the EU market in a commercial activity (Article 3(13), 3(21), 3(22)). You may appoint an authorised representative in the EU (Article 18); importers and distributors have their own duties (Articles 19 and 20). The scope check explains the reporting route for manufacturers without an EU establishment (Article 14(7)).
Is SaaS covered?
A hosted service that no installed product of yours depends on is not a product with digital elements (recital 12; NIS2 may apply instead). A backend your app needs to perform one of its functions is part of your product as a remote data processing solution (Article 3(2), recital 11, Commission guidance C(2026) 5252 section 8).
Is open source covered?
Free and open-source software that its manufacturer does not monetise is not a commercial activity (recital 18). Monetising it in any of the ways recital 15 lists brings it in. Open-source software stewards have the lighter regime of Article 24.
What about important or critical products (Annex III and IV)?
The documentation is the same; the conformity route changes (Article 32(2) to (4): modules B+C or H, or a certification scheme). The scope check tells you the class using the technical descriptions in Implementing Regulation (EU) 2025/2392. The generator does not pretend to replace a notified body.
Which repositories does it understand?
Any repository with text source. Product identification and permissions are read from package.json, app.json (Expo), AndroidManifest.xml, build.gradle, Info.plist, pyproject.toml, Cargo.toml and go.mod. The SBOM covers what cdxgen resolves: npm, PyPI, Maven and Gradle, Go, Rust and more; platform-native layers appear only where resolved.
Who is behind this?
An individual software developer who publishes two apps in the Solana dApp Store and built the generator for them first. Written contact only: support@cradossier.dev. Sources read and the dates are on the sources page.
Refunds
See the refund policy: a refund within 14 days if the generator does not run on your repository and written support cannot fix it.