Free preview at launch
Forge your product documents, release by release. For the EU Cyber Resilience Act.
Scan your code and answer plain questions about your product. DossierForge drafts the technical file, the information and instructions for your users, your vulnerability handling policy and the declaration you sign, on your own machine. At every new release it shows what changed, so you update your documents instead of rewriting them.
Does the Cyber Resilience Act apply to you?
It applies if you sell a product in the EU that connects to a device or a network, directly or indirectly. Products already covered by their own EU rules, such as medical devices, cars and aircraft, are outside it. By an EU estimate from when the law was proposed, roughly 90% of products can be self-assessed: you do the assessment and sign it yourself, with no external auditor.
It asks you to meet security requirements for your product, handle its vulnerabilities, send an early warning about actively exploited ones within 24 hours, and keep a technical file and a signed declaration that show it.
Check your productFrom your answers to your technical file
You answer in plain words. DossierForge puts each answer in the right section of your Cyber Resilience Act technical file and writes the structure and legal references around it.
What you answered
Section 4 of your technical file
4. Information taken into account to determine the support period
Regulation (EU) 2024/2847, Annex VII, point 4; Article 13(8), second subparagraph; Article 13(8), third subparagraph; Article 13(8), fifth subparagraph
End of the support period: 15 June 2034
This end date is stated to buyers of the batch of units these documents were issued for. Each batch is given its own end date, the full support period after that batch is placed on the market.
Support period in years: 8, counted from placing on the market.
Information taken into account to determine the support period pursuant to Article 13(8) of Regulation (EU) 2024/2847:
The product is expected to be in use for five years or more.
Eight years from the date each batch of units is placed on the market. The charger is mounted as a fixed wall installation and is expected to stay in use as a whole for at least eight years, which matches the eight year warranty on its power electronics.
The support period must reflect the expected time in use, taking into account reasonable user expectations, the nature of the product, including its intended purpose, and relevant Union law determining the product's lifetime.
Manufacturers may also take into account the support periods of products with similar functionality supplied by other manufacturers, the availability of the operating environment, the support periods of integrated third-party components that provide core functions, and relevant guidance from the dedicated administrative cooperation group and the Commission.
These factors must be considered proportionately.
Deadlines
Since 11 September 2026
Send an early warning about an actively exploited vulnerability or a severe incident to your national incident authority (CSIRT) and ENISA, the EU cybersecurity agency, within 24 hours. A fuller notification follows within 72 hours, then a final report. This includes products already on the market.
With Maintain, DossierForge checks your components against public vulnerability databases. When you record that a vulnerability is exploited in your product, it drafts the early warning for you to review and send.
From 11 December 2027
The Cyber Resilience Act applies in full: the technical file, the declaration and the product requirements behind them.
DossierForge drafts these documents from your answers and your component list. At each new release you update your answers and generate them again.
Penalties reach EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher.
What it does, and what it leaves to you
What it leaves to you
What it does
You sign the declaration, and the responsibility stays yours.
Each section names the part of the Cyber Resilience Act it answers, so you can check it before you sign.
It knows only what you answer and what the scan finds.
It refuses to finish a dossier while an answer is missing, and it names each one.
It does not decide whether a vulnerability affects your product.
It checks your components against public vulnerability databases and tells you when a new one matches.
It is not legal advice.
Your adviser reviews an editable draft instead of writing one from a blank template.
Pricing
Preview
Free
one product, from the first public build
Run the scan, the questions and the full list of what is missing on one product, and see the first pages of each document, watermarked.
Recommended
Maintain
€1,500 a year
first product, excl. VAT
Every release documented on current rules, with scheduled vulnerability checks and the 24 hour early warning drafted for you.
One-time
€299 once
per product, excl. VAT
The complete documents for one product, yours to keep. New final versions while its rules are current.
€299 comes off your first Maintain year on upgrade.
Talk to the maker for 30 minutes.
The European Commission estimates the documentation, conformity work and reporting at about €12,600 per product. Source
Your €299 One-time payment counts toward your first Maintain year until the last day its rules can make final documents. You see that date before you pay.
Launch pricing. These are the prices the product launches at; buying at them locks them in for your product. Each offer covers the Cyber Resilience Act for one product. Windows and Linux at launch, macOS follows when there is demand.
Who builds DossierForge
I am Rubèn Plantinga. I work as a principal AI engineer and tech lead, designing systems and leading development teams.
DossierForge is my own product, sold by my company Skoft Software in The Hague, KvK 42097143. Every question sent to hello@dossierforge.com reaches me, and I answer it myself.
FAQ
Can I try it before I buy?
The free preview comes with the first public build. It covers one product, including the questions, scan and full list of missing information. It generates watermarked first pages of each document. A licence adds the remaining pages and Word files. You can use the browser scope check now.
What gets generated?
The four Cyber Resilience Act documents: the information and instructions for your users, the technical file, your vulnerability handling policy and the declaration you sign. They come as PDF and Word files in English. You can also draft a separate 24 hour early warning. For a product you placed on the market before 11 December 2027 and no longer sell or change, it generates one reporting record instead.
Why not ask an AI assistant to write it?
An AI assistant can draft a first version of these documents. DossierForge keeps the record behind them: the component list of each release, the answers each document was built from and the rules version it used. At your next release it shows what changed. You generate the documents again. Maintain brings updated rules into your app.
What leaves my machine?
- Licence checks send your key to license.skoft.app.
- Adding a product to a Maintain licence sends your key and the new number of products to checkout.dossierforge.com.
- Update checks contact updates.skoft.app for new app versions. With Maintain, the app asks the same host for updated rules. With One-time, it asks for your purchased rules if they are missing from your machine. Every six hours the app also asks the same host for security notices about your version. None of these requests carries your licence key. If the host refuses one for the place your connection appears to come from, the app asks once more with the id of your licence key.
- Once you agree to it, the app downloads the scanner vulnerability database from its publisher and refreshes it every two hours.
- Vulnerability checks send component names and versions to the public OSV database, then CVE identifiers to the public NVD database. For a component taken from a Git repository, the check sends the repository address and commit instead. If you set an NVD API key, it goes to NVD too. Checks also download the public list of known exploited vulnerabilities from cisa.gov when needed. No product information is sent to CISA.
- If you connect GitHub or GitLab, the app sends your access token to that service to read releases and SBOM files.
- Sending feedback delivers your message, attachments and app version, operating system and processor architecture to Skoft Software. You choose whether to include diagnostics and a reply address.
Licence checks, update checks and security notice checks run automatically. With Maintain, the rules check and the vulnerability watch also run on their own every day, and you can change or stop the watch. The scanner database downloads on a schedule once you agree to it. A connected GitHub or GitLab account is checked every hour. Scanning and document generation run on your machine.
What happens if I release a new version of my product?
Scan or import the new release, review the component changes and update your answers before generating its dossier. The comparison lists added and removed components, version changes and newly matched vulnerabilities.
What does the vulnerability watch do and how often?
With Maintain it runs once a day from the start. Choose a schedule from hourly to weekly, or switch it off. It checks public vulnerability databases and notifies you of new matches or newly flagged active exploitation. Whether your product is actually affected, and so whether you owe the 24 hour early warning, is still your call.
Does it work offline?
Scanning and document generation run locally. Generating a final dossier needs a purchase behind it and rules that are still current. Documents you already generated stay on your disk through an outage of any length. A One-time purchase is also built to keep generating drafts. Licence validation, updates and vulnerability database checks need an internet connection.
What happens to my documents if I stop paying or you disappear?
Your saved PDF and Word files remain on your disk, and you can open and edit them without DossierForge. A One-time purchase keeps producing its documents after a Maintain subscription ends. It is also built to keep your documents and purchased rules usable if our licence service goes away.