EU CRA Readiness Assessment, EN 40000-1-2 (free tool)
The EU CRA Readiness Assessment is a free, no-signup browser tool. It first tests whether the EU Cyber Resilience Act (CRA) applies to a product, then rates the product against the 19 normative activities of FprEN 40000-1-2, the horizontal European standard that CEN and CENELEC drafted under the CRA standardisation request M/606. It is available at https://cvdportal.com/cra-en-40000-readiness and is listed under Free Tools (https://cvdportal.com/tools).
It is different from the SME Cyber Resilience Maturity Assessment. The maturity assessment rates how mature your practices are against ENISA's model. This tool checks, activity by activity, whether the evidence that EN 40000-1-2 describes exists, so you can see what your technical file still needs.
Who it is for
Manufacturers that place products with digital elements on the EU market, and the product security, engineering and compliance staff who assemble the technical file. Integrators and distributors can use it to understand what evidence a supplier should hold.
How it works
Phase 1 applies four applicability gates:
- Is it a product with digital elements?
- Is it made available on the EU market?
- Does it connect to a device or network?
- Does any categorical exclusion apply?
The gates return a scope verdict: in scope, out of scope, review exclusion, or incomplete. Only an in-scope verdict reveals the readiness matrix.
Phase 3 is the readiness matrix over the 19 activities, split into the risk management activities of Clause 6 (RMA-01 to RMA-09) and the lifecycle activities of Clause 7 (CLA-01 to CLA-10). For each activity you record whether the required output exists, choosing evidence exists (assessed), evidence exists (not yet assessed), partial, missing, not applicable, or unknown.
How the score is calculated
- Activities marked not applicable are excluded from the total.
- The readiness percentage is the share of applicable activities where evidence exists.
- The score is shown overall and split across Clause 6 and Clause 7.
How CVD Portal helps
Each activity names the feature that produces and holds the evidence, with its plan tier. In the results, a "How CVD Portal closes your gaps" list shows every activity you rated as a gap, linked to that feature. The tool diagnoses gaps only. Producing, drafting, storing and exporting the evidence is the paid Compliance workspace, from the risk assessment through the Annex VII technical file to the EU Declaration of Conformity.
Is my data stored?
No. The assessment runs entirely in your browser. Your answers are saved to your own browser's local storage so you can come back to them, and nothing is sent to or stored on CVD Portal's servers. Use Copy summary to copy a plain-text report, or Print / PDF to save your results. Reset clears everything.
Does completing it make my products CRA compliant?
No. FprEN 40000-1-2 closed its CEN Formal Vote on 1 October 2026, and CEN gives 18 November 2026 as its availability date. It is not cited in the Official Journal of the European Union, and the CEN project record marks it as "no citation expected" under the CRA. On that record, its publication as an EN brings no presumption of conformity under Article 27. This tool is preparation. CRA conformity requires the documented evidence itself, the conformity assessment, the EU Declaration of Conformity and CE marking.