Scope
Does the Cyber Resilience Act apply to my product?
Published .
Yes, if you make, import or distribute a product with digital elements and make it available on the EU market, whatever the size of your company, unless one of the exclusions in Art. 2 applies. A product with digital elements is software or hardware whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Art. 2(1), Art. 3, point (1)). A pure service that runs only on your own servers is generally outside, unless it is the remote data processing of a product or you also ship software or hardware to customers.
The sections below follow the questions in the order buyers ask them. Each answer names the article it rests on.
What counts as a product with digital elements?
A software or hardware product, together with its remote data processing solutions, including components placed on the market separately (Art. 3, point (1)). The scope clause adds the test: the intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Art. 2(1)).
“a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately”
“This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.”
A router, a firmware image, a mobile app and a plug-in sold on its own all meet the data-connection test. A product with no data connection of any kind, intended or reasonably foreseeable, does not; a purely mechanical product with no electronics is the plain example.
Does the CRA apply to software and apps, including open source?
Yes, to software you supply on the Union market in the course of a commercial activity, paid or free. Open-source software is not outside because of its licence: the test is commercial activity, not a price tag.
“the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge”
Recital 15 lists what can make a supply commercial: a price, paid support beyond the recovery of actual costs, an intention to monetise, a personal-data condition, or donations above cost. Recital 18 states that free and open-source software not monetised by its manufacturer is not supplied in the course of a commercial activity. Counter-example: a hobby library on a public repository with no price, no paid tier and nothing gated is not made available in this sense. The same library shipped inside a product you sell is part of what you place on the market. The detail is in Free software and the CRA: money is not the test.
Does the CRA apply to SaaS and web services?
A service that runs only on your own infrastructure is generally not a product with digital elements, so generally no. Two things pull it back in: software or hardware you ship to customers (apps, agents, connectors, gateways), and a backend that counts as the product’s remote data processing.
“data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions”
Counter-example: a browser-only invoicing tool is outside. Add a mobile app that customers install and the app is in scope on its own. The full reasoning is in Does the CRA apply to SaaS?, and the free remote data processing check runs the three questions of Art. 3, point (2) for your backend.
Which products are excluded?
The main exclusions: products to which the Union acts listed in Art. 2(2) apply (medical devices, in vitro diagnostic medical devices, motor vehicle type-approval under Regulation (EU) 2019/2144); products certified under the civil aviation Regulation (EU) 2018/1139 (Art. 2(3)); equipment within the scope of the marine equipment Directive 2014/90/EU (Art. 2(4)); like-for-like spare parts (Art. 2(6)); and products developed or modified exclusively for national security or defence purposes, or specifically designed to process classified information (Art. 2(7)). Art. 2(5) also lets the Commission limit or exclude the Regulation by delegated act for products covered by other Union rules. Read each provision in the Official Journal before relying on it.
“This Regulation does not apply to products with digital elements to which the following Union legal acts apply:”
“This Regulation does not apply to spare parts that are made available on the market to replace identical components in products with digital elements and that are manufactured according to the same specifications as the components that they are intended to replace.”
The exclusion follows the provision, not the product category: a connected product that none of these provisions reaches stays in scope. A replacement part built to different specifications than the component it replaces is not described by Art. 2(6).
Being in scope is a separate question from which conformity route applies. Some categories are named in the annexes: routers, modems intended for the connection to the internet, and switches are listed in Annex III, Class I (see the network device page), and hardware security modules and secure elements can fall under Annex IV where they meet the Commission’s technical description. The product class pages list the other categories.
Are small companies or startups exempt?
The scope clause sets no size threshold. Art. 2(1) turns on the product and its data connection, not on headcount or turnover, so a two-person startup that sells a connected device under its own name is a manufacturer in the sense of Art. 3, point (13). The fine ceilings of Art. 64 are set by the obligation breached, not by company size. Size does count when an individual fine is set: the size of the company, in particular for microenterprises and SMEs including start-ups, is one of the circumstances weighed (Art. 64(5)(c)), and under Art. 64(10) (as corrected by the corrigendum published in OJ L 2025/90555 of 2 July 2025), read with recital 120, the administrative fines of Art. 64(2) to (9) do not apply to microenterprises and small enterprises for missing the 24-hour early-warning deadline of Art. 14(2)(a) or 14(4)(a). Microenterprises and small enterprises may also provide the technical documentation in a simplified format, to be set by Commission implementing act (Art. 33(5)), and Member States are to offer them awareness, training and support measures where appropriate (Art. 33(1)). See the fines page.
Does it apply if my company is outside the EU?
Yes, if you make products available on the Union market. The hook is the market, not the seat of the company: Art. 2(1) covers products made available on the market, and Art. 3, point (22) defines that as supply on the Union market. The manufacturer definition in Art. 3, point (13) has no condition on where the company is established.
“a natural or legal person established in the Union who places on the market a product with digital elements that bears the name or trademark of a natural or legal person established outside the Union”
Counter-example: a company that never supplies the Union market makes nothing available on it. A non-EU manufacturer whose product reaches the Union stays the manufacturer; the business established in the Union that first places the product on the Union market under the non-EU party’s name is the importer (Art. 3, point (16)), and later sellers are distributors. A manufacturer may appoint an authorised representative in the Union by written mandate (Art. 18(1)); that is an option, not a duty, and the obligations of Art. 13(1) to (11), (12) first subparagraph and (14) cannot form part of the mandate (Art. 18(2)).
Which role am I: manufacturer, importer or distributor?
Usually the name on the product decides. Sell it under your own name or trademark and you are the manufacturer; as a business established in the Union, place on the market a product that bears a non-EU party’s name and you are the importer; make a product available without affecting its properties and you are the distributor.
| Role | Definition | Key duties |
|---|---|---|
| Manufacturer | Art. 3, point (13) | Annex I, Art. 13, Art. 14 |
| Importer | Art. 3, point (16) | Art. 19 |
| Distributor | Art. 3, point (17) | Art. 20 |
Rebranding changes the role: an importer or distributor that places a product on the market under its own name or trademark, or substantially modifies it, is treated as the manufacturer (Art. 21). Anyone else who substantially modifies a product and makes it available on the market is also treated as a manufacturer (Art. 22). See which CRA role is yours.
When do the duties start?
Article 14 reporting duties have applied since 11 September 2026. Chapter IV (notification of conformity assessment bodies) applies from 11 June 2026, and the rest of the Regulation from 11 December 2027 (Art. 71(2)).
“This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.”
The timeline sets out what each date means for each role.
What are the penalty brackets?
Article 64 sets three ceilings, chosen by the obligation breached and not by company size: EUR 15 000 000 or 2.5 % (Art. 64(2)), EUR 10 000 000 or 2 % (Art. 64(3)) and EUR 5 000 000 or 1 % (Art. 64(4)), each a share of total worldwide annual turnover for the preceding financial year, whichever is higher. When an individual fine is set, company size is one of the circumstances weighed (Art. 64(5)(c)). The ceilings describe the structure of the law, not a forecast about any company. Detail: How much are CRA fines?
Five-question self-check
- Does it contain software or hardware whose intended purpose or reasonably foreseeable use includes a data connection to a device or network? (Art. 2(1))
- Do you supply it on the Union market in the course of a commercial activity, paid or free? (Art. 3, point (22))
- Is it governed by one of the Union acts listed in Art. 2(2) to (4), a like-for-like spare part (Art. 2(6)), or developed exclusively for national security or defence or designed to process classified information (Art. 2(7))?
- Does it carry your name or trademark, or a non-EU party’s name that you bring into the Union? (Art. 3, points (13), (16), (17))
- If a cloud backend is involved: is its software designed by or for you, and could the product not perform one of its functions without it? (Art. 3, point (2))
Yes to 1 and 2 and no to 3 points to the Regulation applying to you, in the role that question 4 suggests. Confirm against the Official Journal before relying on it. Anything less clear is a grey zone, and the free Cybiq check turns it into concrete next steps.
Frequently asked questions
Does the CRA apply to a product I only resell?
Yes, in a role. If you pass the product on unchanged under the maker’s name you are a distributor with the due-care duties of Art. 20. If you sell it under your own name or trademark, or substantially modify it, Art. 21 treats you as the manufacturer.
Is a mobile app in scope if it only talks to my cloud service?
Generally yes, if you supply it on the Union market in the course of a commercial activity and no Art. 2 exclusion applies. It is software you supply to devices, and its purpose includes a data connection to a network (Art. 2(1), Art. 3, point (1)). Whether the cloud backend is part of the product is a separate test under Art. 3, point (2): software designed by or for the manufacturer, without which the product could not perform one of its functions.
Does the reporting duty reach products I sold before September 2026?
Yes, for in-scope products already on the market. Article 14 has applied since 11 September 2026 and reaches them (Art. 69(3)). The other requirements reach products placed on the market before 11 December 2027 only if those products are substantially modified from that date (Art. 69(2)).
Sources
- Regulation (EU) 2024/2847, OJ L, 20.11.2024 (CELEX 32024R2847): Art. 2, Art. 3, Art. 13, Art. 14, Art. 18 to 22, Art. 33, Art. 64, Art. 69, Art. 71, recitals 15, 18 and 120.
- Commission guidance C(2026) 5252, 27 July 2026, non-binding, on free and open-source software.
Read next
- What the CRA is and who it binds
- Scope questions in the FAQ
- Glossary: product with digital elements
- Free tools
Orientation, not legal advice. Verify against the official text before relying on any item.