Hardware Compliance Handbook

Hardware Compliance Knowledge Base

**A fact-checked, open reference on the EU laws that govern hardware and IoT cybersecurity — CRA, RED, NIS2, and the Cybersecurity Act/EUCC, in one place instead of four.**

[](https://creativecommons.org/licenses/by/4.0/) [](#repository-structure) [](https://platanor.com)

Prepared by **Platanor Technologies** ([platanor.com](https://platanor.com)) — an embedded security firm for IoT device manufacturers.

**Contents:** [Quick start](#quick-start) · [What this is](#what-this-is) · [Repository structure](#repository-structure) · [Technical reference](#technical-reference-technical) · [Methodology](#methodology-and-sourcing) · [Using with an LLM](#how-to-use-this-with-an-llm) · [Claude Skill](#installing-this-as-a-claude-skill) · [Feedback](#feedback) · [License](#license) · [Discussions](https://github.com/Platanor/hardware-compliance-handbook/discussions)

---

Quick start

• Just want an answer? Open `cra/faq.md`, `red/faq.md`, `nis2/faq.md`, or `csa/faq.md` — each is a practical Q&A for hardware/IoT manufacturers, no legal background required.
• Working with an LLM? Drop a processed guide into your prompt and ask, e.g.: "Using cra/product-risk-classes.md and red/essential-requirements.md, does a Wi-Fi-connected baby monitor need a notified body, or can we self-assess?"
• Need the exact legal wording? Every processed guide links back to its source in `primary-sources/` — full official text, chunked by article.
• Need the engineering, not just the regulation? `technical/` covers how to actually build the thing the law asks