CRA · MACHINERY · RED · NIS2 · GDPR

CRA compliance software. From first question to technical file.

One file for the CRA and the Machinery Regulation, with RED, NIS2 and the GDPR alongside, and where they overlap.

Try the example Claim your free Lite licence Runs locally. Your data stays yours.

Lite is free. Renews every year at no cost. Essentials €99 a month, excl. VAT. See plans

Before you start

Know what you rely on.

Who maintains it

Meet the maintainer.

Marcel Depré works on CRA, NIS2 and IEC 62443 compliance and teaches the CRA course via Mikrocentrum.

Privacy

Your data stays yours.

Runs locally. Your projects, evidence and documents are files on your own device. We don't host them and don't see them.

No tracking in the app. By default Crosswalk sends no project content or telemetry to us.

Licensing. Activating a licence sends your licence key and a short device label.

AI is opt-in. Managed AI requests go through our relay to our AI provider; the relay stores no prompts or answers, and we use none of it to train models. On Essentials and Professional you can use your own provider instead, or none.

Getting Lite asks for an email address, the licence holder's name and two confirmations. No payment details.

Read clause 14 and the data processing annex

Our own file

Check our own compliance file.

We run Crosswalk on itself, unfinished parts included.

Home of our own compliance file: set up and assess done, fix and prove in progress, the declaration not yet issued. — Open our compliance file

The output

Read the documents first.

Open them without signing up.

Part of page 3 of the CRA product audit of the Edge Controller EC-200, an invented product: the compliance status table for the essential requirements of CRA Annex I Part I, with 14 in place, 0 in each of the six other statuses (from in place with evidence missing to not applicable) and 14 applicable in total; under it the first two requirements, ER-1 Risk-based cybersecurity and ER-b Secure-by-default configuration, each in place with evidence recorded. — Produced by Crosswalk from the example file.

or open the software example

How it works

Set up, assess, fix, prove.

Set upFind out what applies.Answer plain questions. Crosswalk shows which laws apply, and why.

The CRA for an invented machine builder: ticked and in scope, for products with software or connectivity placed on the EU market, with the standards chosen for it. — The CRA, in scope for an invented machine builder.

AssessSee where you stand.Give each requirement your status and the evidence behind it.

Vulnerability handling under the CRA for an invented machine builder, practice by practice: identification and testing 4 of 4 in place, remediation and updates 6 of 6, disclosure and CVD 2 of 3, with 1 partly in place. — Where the example stands on vulnerability handling.

FixClose the gaps.Every gap becomes an action with an owner, a date and a check.

An action in the Work queue: renew security.txt, its owner, its due date and when it is done. — From our own compliance file.

ProveHand over the proof.Crosswalk produces the technical file and declaration from your answers.

What one product hands over: the technical files, the EU declaration of conformity, the datasheet and the index. — What one product hands over.

Claim your free Lite licence See plans

AI interview

Answer one question at a time.

It asks for evidence, not your word.

Accept what holds.

Nothing is saved until you accept it.

VH-5Vulnerability disclosure policy

StatusPartial

Evidencehalvard.example/security

ActionRun a test report

AcceptedIngrid Haugen

Recorded, with who accepted it.

Question

Where is your vulnerability disclosure policy published?

On our website, halvard.example/security.

Question

What does it promise a reporter?

An answer within three working days.

Question

Has a report gone through it yet?

Not yet.

On the paid plans.

The dates

Know what applies when.

25 May 2018GDPR applies

17 Oct 2024NIS2 transposition deadline

1 Aug 2025RED cybersecurity

11 Jun 2026CRA notified bodies

11 Sep 2026CRA reporting

20 Jan 2027Machinery Regulation

11 Dec 2027CRA in full

Filled dates have passed.

How it maps

Trace every requirement to the law.

Each requirement cites its provisions, word for word. Standards are cited by clause, never copied or sold.

The text of CRA Annex I Part I (2)(d), word for word, as requirement ER-d shows it: protection from unauthorised access by appropriate control mechanisms. — The provision behind requirement ER-d, word for word.

No sign-up

Start with the example.

Try the example Claim your free Lite licence

Lite is free. Renews every year at no cost. Essentials €99 a month, excl. VAT. See plans

Status	Count
In place	14
In place, evidence missing	0
Partially implemented	0
Planned	0
Not in place	0
Not yet assessed	0
Not applicable	0
Applicable total	14