01
CRA Scope & Classification
Understand whether the product is in scope, how it is categorised and which conformity route may apply.
CRA CONSULTING FOR CONNECTED PRODUCTS
Turn CRA requirements into an engineering plan.
From scope and classification to lifecycle processes and technical evidence, Pictor helps connected-product teams build a practical, defensible route to CRA readiness.
Regulatory milestones
11 September 2026
Reporting obligations apply.
11 December 2027
Main CRA obligations apply.
Is your organisation affected?
CRA applies broadly to hardware and software products with digital elements made available on the EU market, subject to defined exclusions. Pictor helps teams establish the product scope, their economic-operator role and the practical work required next.
- Embedded Devices
- Industrial Products
- Connected Systems
- Software-enabled Equipment
CRA SERVICES
Six workstreams that make CRA operational.
02
Readiness Gap Assessment
Assess current development, documentation and support processes against the requirements relevant to the product.
03
Secure Product Lifecycle
Translate CRA obligations into engineering activities across design, development, production, updates and post-market support.
04
Vulnerability Management
Establish responsibilities and processes for intake, triage, remediation, coordinated disclosure and regulatory reporting.
05
Technical Documentation
Prepare the architecture rationale, risk material, lifecycle records and technical evidence required for the chosen conformity path.
06
Interim Compliance Leadership
Provide senior ownership to coordinate engineering, product security, quality and regulatory stakeholders.
HOW PICTOR WORKS
Five stages, each with a named output.
01
Scope
Product, role, category and applicable obligations.
02
Assess
Current maturity, gaps, dependencies and deadlines.
03
Plan
Prioritised roadmap, owners, deliverables and review points.
04
Implement
Processes, engineering activities and working templates.
05
Evidence
Traceable technical documentation and decision rationale.
At every stage, the output is named and usable. The goal is not a generic compliance presentation, but work products your teams can operate and maintain.
DELIVERABLES
What you can expect to hold.
- Scope and classification memo
- Readiness scorecard and prioritised gap roadmap
- Product cybersecurity risk-assessment structure
- Secure development lifecycle mapping
- Vulnerability-handling and reporting playbook
- SBOM and component-governance approach
- Support-period and update-process definition
- Technical documentation evidence map
- Conformity-assessment preparation pack
- Governance, ownership and review cadence
The readiness gap
73%
of surveyed SMEs requested templates for required technical documentation.
24%
reported using threat modelling in their current workflow.
The difficult part is rarely recognising that CRA matters. It is assigning ownership, changing the product lifecycle and building evidence that stays current. That is where Pictor focuses.
ENISA SME CRA Survey Report, 2026WHY PICTOR
Engineering credibility, not compliance theatre.
- More than 20 years in functional safety and system architecture.
- Experience in safety-critical embedded systems.
- Senior practitioners directly involved.
- Ability to connect risk, lifecycle, architecture and documentation.
- Practical support alongside internal engineering, quality, legal and product teams.
QUESTIONS
CRA, answered plainly.
NEXT STEP
Start with scope. Finish with defensible evidence.
We map CRA obligations to your product lifecycle and existing documentation.