CRA work combines product assessment with lifecycle processes. Establish product boundaries, operator responsibilities and classification, then assess technical controls, documentation, support arrangements and vulnerability handling. Manufacturer reporting obligations have applied since 11 September 2026. Prepare escalation contacts and reproducible product and version evidence so that a report can be assembled promptly when a reportable event is identified.
Project preparation
Provide the intended markets, product architecture, interfaces, sample configuration, software versions and available design evidence. Agree testing access, restrictions and a version baseline. Record remediation changes and retest the affected controls before closing findings.
Delivery and scope
The agreed deliverables may include an applicability record, gap list, test plan, findings and retest records. Confirm the report purpose and any additional certification or conformity assessment steps required by the recipient. The preparation guidance below explains the information needed to scope a proposal.
Plan your testing project
What determines the testing scope?
Product boundaries, economic operator roles, classification, support periods and reporting responsibilities; plan both technical evidence and organizational procedures. Scope is confirmed against current official requirements and the actual product configuration.
What should be prepared before quotation?
Provide a product description, intended markets, interfaces, architecture and data-flow diagrams, hardware and software versions, update design, account roles and available test samples. Include prior reports and known issues if available.
How are lead time and price determined?
They depend on applicable requirements, number of interfaces and variants, test access, document readiness and remediation cycles. After a document review we agree milestones and quotation assumptions. A universal price or fixed turnaround would not reflect these differences.
What commonly causes retesting?
Missing interface descriptions, inaccessible administrator functions, undocumented cloud dependencies, changing firmware during testing and insufficient evidence of remediation. Agree a version baseline and track each change against affected test cases.
What will be delivered?
The agreed scope may include an applicability record, gap list, test plan, findings, remediation and retest records, and a test report. Confirm report purpose, recipient requirements and any need for a notified or certification body before placing the order.