Does the CRA apply to my company? A scope checklist

The checklist

Go through these in order. If you answer "no" to one of the first three, the CRA most likely doesn't apply to that product. If you get to the end with "yes" answers, it does, and Article 14 reporting has applied since September 11, 2026.

• 1. Is it a product with digital elements? Article 3 defines it as a software or hardware product and its remote data processing solutions, including components placed on the market separately. Installed software, mobile and desktop apps, firmware, connected devices and network equipment all qualify.
• 2. Does it connect to something? Article 2(1) covers products whose intended or reasonably foreseeable use includes a direct or indirect, logical or physical data connection to a device or network. That is nearly everything with software in it.
• 3. Is it made available on the EU market in the course of a commercial activity? Paid or free. Where your company is based doesn't matter; where the product is supplied does.
• 4. Are you the manufacturer? The manufacturer develops or manufactures the product, or has it designed or made, and markets it under its own name or trademark. An importer or distributor that sells your product under its own brand, or substantially modifies it, takes on manufacturer obligations.
• 5. Is it outside the excluded sectors? See the exclusions below.
• 6. Is it more than a pure online service? See the SaaS section below.

What is excluded

Article 2 leaves out products already covered by their own EU rules or by national security:

• medical devices (Regulation (EU) 2017/745) and in vitro diagnostic medical devices (Regulation (EU) 2017/746);
• vehicles under the type-approval rules of Regulation (EU) 2019/2144;
• products certified under the EU civil aviation rules (Regulation (EU) 2018/1139);
• marine equipment under Directive 2014/90/EU;
• spare parts made to the same specifications to replace identical components;
• products developed or modified exclusively for national security or defense, or specifically designed to process classified information.

If your product is a component sold to a manufacturer in one of these sectors, look carefully: the exclusion follows the regime the product falls under, and a general-purpose component sold separately may still be in scope.

SaaS: generally out, with one important exception

The CRA regulates products, not services. A pure SaaS application, used in a browser and not tied to a product you ship, is generally outside it. Other EU laws, such as NIS2 depending on your sector, may apply instead.

The exception is remote data processing: data processing at a distance, designed and developed by or for the manufacturer, without which the product could not perform one of its functions. The cloud backend that a smart camera, a thermostat or a mobile app depends on is part of the product. If you sell a device and run its cloud, both are in scope.

Open source

Recital 18 says that providing free and open-source software that is not monetized should not be considered a commercial activity. But a company that integrates open-source components into a product it sells is the manufacturer of that product, components included. The CRA also creates a lighter regime for open-source software stewards, legal persons that systematically support open-source projects intended for commercial activities. Their reporting obligations apply from December 11, 2027, and Article 64(10) excludes them from fines.

Which class is your product?

Scope answers whether the CRA applies. Class answers how you prove conformity from December 11, 2027.

• Default: most products. Self-assessment by the manufacturer is allowed.
• Important, class I (Annex III): for example operating systems, password managers, VPNs, and routers and modems. Self-assessment is possible only when you apply harmonized standards or a relevant certification scheme in full; otherwise a notified body is involved. Check whether the relevant harmonized standards have been published by the time you read this.
• Important, class II (Annex III): for example hypervisors and container runtime systems, and firewalls. Third-party assessment by a notified body is required.
• Critical (Annex IV): a short list, including hardware devices with security boxes and smart meter gateways, which may require European cybersecurity certification.

The categories are defined by core functionality, so read the Annex III descriptions, and the Commission's technical descriptions, before you decide.

Already on the market?

Products placed on the market before December 11, 2027 only have to meet the CRA requirements if they are substantially modified after that date (Article 69(2)). Reporting is the exception: Article 14 applies to all in-scope products, including ones sold before that date (Article 69(3)). So even a product you stopped selling but still support needs a reporting process today.

If you are in scope: what to do, in order

1. Now: set up vulnerability intake, an SBOM per release, and a 24-hour reporting runbook. Work out which EU CSIRT receives your reports under Article 14(7).
2. Decide whether you want an EU authorised representative. Article 18 makes it optional.
3. Talk to your EU importers and distributors. Under Article 19, importers must check your conformity assessment, technical documentation and CE marking.
4. By December 11, 2027: meet the Annex I requirements, set a support period (at least five years unless the product is expected to be used for less, under Article 13(8)), write the technical documentation, complete the conformity assessment, and apply the CE marking.

Reprisa builds processes, tooling and evidence. It is not a law firm, a notified body or an authorised representative, and this guide is not legal advice.

Frequently asked questions

Sources

Related