Direct answer: the first question to ask a CRA consultant is not "how many clients have you done" but "can you classify my products family by family, and determine my supply-chain role line by line". These two determinations decide the CRA workload and the assessment route; get them wrong and the technical documentation and conformity assessment that follow must be redone. Next, check whether the consultant can handle legal compliance, process and security technology together, and whether your reporting obligations are already operational.
Three kinds of CRA helper on the market
| Role | What they mainly do | Best suited to |
|---|---|---|
| Certification and testing bodies | Product testing, third-party conformity assessment | Important products class II, critical products, or class I products with no harmonised standard available |
| Security tool vendors | SBOM, vulnerability scanning, code analysis and similar tools | Producing and automating technical evidence |
| Management consultants | Classification and role determination, system and process design, technical documentation and evidence preparation | End-to-end planning from regulatory determination to an auditable system |
The three roles differ and most companies combine them. When choosing a consultant, confirm they know where they sit among the three.
Nine criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Classification by product family | Does each of my product families fall under default, important class I, important class II or critical? On what basis? |
| Supply-chain role by product line | For my own-brand, ODM and OEM lines, am I the manufacturer, importer or distributor in each case? |
| Legal, process and technology covered together | Who determines the regulation, who builds the system, who reviews the technical evidence? Is it one team? |
| Reporting obligations already operational | The 24-hour early warning and 72-hour notification have applied since 11 September 2026; is my process ready? |
| Not waiting for harmonised standards | The harmonised standards are not yet published; what should I prepare against now? |
| Handling overlapping regulations | How do the RED cybersecurity requirements for radio equipment, the Machinery Regulation and the AI Act get planned together with the CRA? |
| Who leads, and is it outsourced | Who actually runs the engagement? What are their qualifications? Will it be subcontracted? |
| Named cases and reference customers | Can you provide named cases or reference contacts in my industry and at my scale? |
| Clarity of the quote | Which deliverables are included? Which are not? How are extras charged? |
When you need an external consultant
Classification and role determination, and planning the assessment route, are most error-prone when products span several classes, when own-brand, ODM and OEM lines coexist, or when products are important class I or above; that is where an external consultant adds the most. If all products are default class and you already have a mature secure development process and SBOM, focus external resources on the determinations and on checks at key milestones. If products are important class II or critical and only the third-party assessment is missing, go directly to a notified body or test laboratory; if you only need technical evidence such as SBOM or vulnerability scans, a security tool vendor may be the more direct route.
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant. Six companies are currently in CRA consulting engagements with Winners.
- Classification by product family: determined item by item against CRA Annexes III and IV and the technical descriptions in Implementing Regulation (EU) 2025/2392
- Supply-chain role by product line: determined line by line, with recommendations on the contractual clauses for ODM and OEM arrangements
- Legal, process and technology covered together: three disciplines in one team; one body of evidence serves the CRA and other regulations
- Reporting obligations already operational: the vulnerability and incident reporting procedure is built first, in parallel with the conformity assessment
- Not waiting for harmonised standards: prepare against the published draft standards, then gap-check and reinforce once they are published
- Handling overlapping regulations: the RED-to-CRA transition, the Machinery Regulation and Article 12 of the AI Act are planned together
- Who leads, and is it outsourced: VP- and director-level consultants guide the whole engagement and nothing is outsourced; the team holds ISO lead-auditor credentials
Related questions
- How do I estimate CRA consulting fees? It depends on the class distribution of your product families, the supply-chain role of each product line, the number of combinations these create, and the maturity of your existing processes. Estimating a CRA budget
- How long does CRA compliance take? It is set by the statutory dates and notified-body scheduling. CRA timeline and the steps that cannot be compressed
- What if my product has AI functions? Article 12 of the CRA gives high-risk AI products that comply with the CRA a presumption of conformity with Article 15 of the AI Act for the cybersecurity part. ISO 42001 and the AI Act
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.