Close the gaps the assessment found, document by document.
The sprint turns the gap list into the documents and processes the Cyber Resilience Act asks a manufacturer to have: the technical documentation (Annex VII), the user information (Annex II), the declaration you sign (Annex V), an SBOM and a vulnerability-handling process (Annex I Part II), and a support period you can defend (Art. 13(8)). Quoted at the end of the assessment; the quote depends on the product class and the number of products.
Not legal advice. The manufacturer declares conformity; SkyQon does not carry out a conformity assessment.
A fixed quote needs a known scope, and the assessment is what produces one. The sprint starts from its gap list, works through the items in the order the plan set, and leaves each one as a document or a running process with evidence behind it. We write with you, not for you: every document names your product, your decisions and your people, because the manufacturer is the one who signs.
What it finds
Which documents and processes are still missing after the assessment, and what each one has to contain for your product.
What you get
A technical documentation skeleton, the user information, a declaration draft you sign, an SBOM and vulnerability-handling process, a disclosure policy with security.txt, update evidence and a documented support period.
What it is not
Not a conformity assessment, not a certificate, not a signature on your declaration, and not legal advice.
What it covers
Seven pieces of work, each with its article.
1. Technical documentation skeleton (Annex VII)
The structure of the file Article 31 requires you to draw up and keep, point by point: the product description, its design and development, the cybersecurity risk assessment, the applicable requirements, the standards or specifications applied, the test reports, the declaration and the SBOM (Annex VII, points 1 to 8). Each point is filled where the assessment found material and marked "to complete" where it did not. For micro and small enterprises: the simplified form of Art. 33(5) has not been adopted yet, and every element is still required.
2. User information (Annex II)
The information and instructions users must receive under Annex II, points 1 to 9, including who the manufacturer is and how to reach it, where to report a vulnerability, the intended purpose and the security properties, secure installation and configuration, how updates are applied, and the end of the support period, which must also be stated at the time of purchase (Art. 13(19)).
3. The declaration draft you sign (Annex V / VI)
A draft EU declaration of conformity with the elements of Annex V, or the simplified wording of Annex VI where it is allowed, marked draft until you sign it. The manufacturer draws it up (Art. 28); SkyQon does not declare conformity and does not sign.
4. SBOM and vulnerability handling (Annex I Part II (1), (2))
An SBOM generated from your build system in CycloneDX or SPDX, covering at the very least the product's top-level dependencies (Part II (1); the Commission's format act under Art. 13(24) is not adopted yet), and a written process for addressing and remediating vulnerabilities without delay, with security updates provided separately from functionality updates where technically feasible (Part II (2)).
5. Disclosure policy and security.txt (Part II (5), (6))
A coordinated vulnerability disclosure policy, published and enforced (Part II (5)), and the contact address for reporters that Part II (6) asks for, served as a security.txt that the common checks pass. With the Incident Reporting add-on, SkyQon then checks that file every day from outside.
6. Secure update evidence (Part II (7), (8))
Written evidence of how updates reach the product: the mechanism, how updates are signed and with which identity, that security updates go out without delay and free of charge, and the advisory that accompanies them (Part II (7) and (8)). Where the signing certificate comes from a CA you run, Private CA Management in the dashboard can issue it from a CSR.
7. Support period determination (Art. 13(8))
A documented decision on the support period: the expected time in use, the floor of at least five years unless the product is expected to be in use for less (Art. 13(8)), what the period commits your engineering team to for vulnerability handling (Annex I Part II), that each security update issued during it stays available for at least ten years or the rest of the period, whichever is longer (Art. 13(9)), and the end date stated at purchase (Art. 13(19)).
Limits
Stated before you ask for a quote.
Evidence, not conformity
The manufacturer declares conformity (Art. 28) and affixes the CE marking (Art. 30). SkyQon does not carry out a conformity assessment, does not certify and does not sign the declaration. Where a notified body is required, the sprint prepares the file it will read; it does not replace it.
When a notified body is needed
An important class I product can be self-assessed only when harmonised standards, common specifications or a European cybersecurity certification scheme covering the requirements are applied; none has been cited in the Official Journal yet (checked 12 November 2026), so today it needs a notified body (Art. 32(2)). An important class II product always does (Art. 32(3)). Critical products (Annex IV) follow the notified-body route too until a certification scheme is made mandatory for them (Art. 8, Art. 32(3)).
The quote is a quote
From €5,000, fixed at the end of the assessment. It depends on the product class and the number of products, and it is written down before you order; it is not a ceiling promised in advance.
The assessment comes first
The sprint is scoped from the assessment's gap list. Without it there is no list to work from and no basis for a fixed quote.
Not legal advice
The documents cite the Regulation so your counsel can review them quickly. Questions the text does not settle are flagged, not decided.
Ask for a quote, or a question
The quote follows the assessment. If you have not done one yet, we will say so and propose it. We reply within one business day. Prices exclude VAT.