Is my product in scope of the CRA?

The single most common CRA question is also the first one you need to answer: does this regulation even apply to my product? Get it wrong in one direction and you waste effort; get it wrong in the other and you ship something non-compliant. This guide gives you a structured way to reason about it. It is a starting point, not a substitute for reading Regulation (EU) 2024/2847 or getting professional advice on edge cases.

Step 1 — Does it have "digital elements"?

The CRA applies to products with digital elements: any software or hardware product, plus its remote data-processing solutions, whose intended purpose includes a direct or indirect data connection to a device or network. Ask yourself:

• Does the product contain software or firmware?
• Can it connect — directly or indirectly — to another device or to a network (wired, Wi-Fi, Bluetooth, cellular, etc.)?

If the answer is yes, it is very likely a product with digital elements. This is intentionally wide: a smart thermostat, a mobile app, an operating system, a networked printer, a firmware image, and a software library can all qualify. Even indirect connectivity counts — a component that connects through another device is included.

Step 2 — Is it placed on the EU market in the course of a commercial activity?

The CRA covers products made available on the EU market as part of a commercial activity — sold, licensed, or otherwise supplied to customers in the Union. A purely internal tool you build and use only inside your own company, and never place on the market, is a different situation. Whether something is "made available" can be subtle (for example, monetised or professionally supported offerings), so treat borderline cases carefully.

Step 3 — Free and open-source software: a nuanced case

The CRA is designed not to burden genuine open-source development done outside a commercial activity. Non-commercial open-source software, and individual contributors who are not monetising their work, are largely outside the manufacturer obligations. However, once open-source software is supplied commercially — for instance sold, or offered with paid support as part of a business — the party doing so can take on obligations. There is also a lighter, tailored role introduced for "open-source software stewards". If your product includes open-source components, you remain responsible for the security of the product you place on the market, including those components.

Step 4 — Check the explicit exclusions

Some products are carved out because they are already covered by sector-specific EU cybersecurity rules, or otherwise addressed. At a high level, products excluded or handled elsewhere include categories such as:

• Certain medical devices covered by the medical device regulations;
• Motor vehicles covered by their own type-approval cybersecurity rules;
• Civil aviation products under aviation safety rules;
• Certain marine equipment;
• Products developed exclusively for national security or defence purposes, and certain products processing classified information.

Pure SaaS / cloud services are generally addressed by other frameworks (such as NIS2) rather than the CRA — but the "remote data-processing solutions" that are necessary for a product to perform its function are pulled back into the product's scope. So a cloud back-end that your device cannot work without is treated as part of the product.

Step 5 — If in scope, find your risk class

Being in scope is only the first fork. The CRA then sorts products by risk, which determines how you can demonstrate conformity:

• Default products — the majority — can typically use self-assessment.
• Important products (Annex III), split into class I and class II, face stricter routes.
• Critical products (Annex IV) face the highest expectations, potentially including mandatory certification.

Examples of "important" categories include things like password managers, network management systems, and certain security-sensitive components — products whose compromise could cause wider harm. Our separate article on risk classes goes into detail.

A quick decision recap

• Has code + can connect? → likely a product with digital elements.
• Placed on the EU market commercially? → obligations likely apply.
• Falls under a listed sector exclusion? → may be governed elsewhere instead.
• Still in? → determine Default / Important / Critical and pick your conformity route.

This article is general information, not legal advice. Scope and exclusions have precise legal wording — always check Regulation (EU) 2024/2847 and seek advice for borderline cases.