Does the Cyber Resilience Act apply to what you build? For a small software company or a maker of connected devices, the honest answer is often "it depends". Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), does not come with a checklist, but its articles and recitals answer most cases once you ask the right questions in the right order.

Below are the eight questions behind Vulnio's free scope check, with the article or recital each answer rests on. The result is one of three: in scope, out of scope, or unclear. Where the text gives no clear rule, the honest answer is "unclear", and that is the point to ask a lawyer.

1. What do you make?

The CRA covers "products with digital elements": a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately (Art. 3(1)).

  • Installed software, apps, libraries and devices with firmware are the core of the definition.
  • Remote data processing is covered only as part of a product. An API or database service that a manufacturer develops for its own mobile app is an example (recital 11).
  • Browser-only SaaS is the grey zone. Recital 12 says websites that do not support a product's functionality are out of scope and points SaaS, PaaS and IaaS to the NIS2 Directive, but the articles contain no explicit SaaS exemption. The answer here is "unclear".
  • Paid plugins, themes and extensions for someone else's platform: the regulation has no specific rule. Under the general definition they appear to be in scope.

2. Can it connect to a device or network?

The CRA applies to products whose intended or reasonably foreseeable use includes "a direct or indirect logical or physical data connection to a device or network" (Art. 2(1)). Internet, local network, Bluetooth, USB and update downloads all count. A product with no data connection at all is out of scope.

3. Is it offered to users in the EU?

"Placing on the market" is the first making available on the Union market; "making available" is supply for distribution or use on the Union market in the course of a commercial activity, whether paid or free (Art. 3(21) and 3(22)).

If you never supply the EU, have no EU reseller or importer, and EU users cannot obtain the product, it is out of scope. A worldwide download or an app store listing makes the answer "unclear".

4. How do you supply it?

"Commercial activity" is not defined in the articles. Recital 15 gives examples of what counts:

  • charging a price for the product;
  • charging for support above actual costs;
  • intending to monetise, for example through a platform that monetises other services;
  • requiring personal data for purposes other than security;
  • accepting donations that exceed costs.

Being free does not take a product out of scope on its own: the definition of manufacturer includes products marketed "free of charge" (Art. 3(13)).

Free and open-source software that is not monetised is not a commercial activity (recital 18). An open-source steward, a legal person that supports open-source software intended for commercial activities, has a lighter regime (Art. 24) and cannot be fined (Art. 64(10)(b)). Open source with paid support or donations above costs counts as commercial; the regulation sets no threshold, so that case is "unclear".

Software used only inside your own organisation: there is an explicit rule only for public administrations developing products exclusively for their own use (recital 16). For companies the answer is "unclear".

5. What is your role?

A manufacturer develops a product, or has it developed, and markets it under its own name or trademark (Art. 3(13)). Importers and distributors have their own, separate obligations under the CRA. The reporting duty in Art. 14 is the manufacturer's.

6. Does a sector exclusion apply?

These products are outside the CRA because other EU rules cover them:

  • medical devices and in-vitro diagnostic devices (Art. 2(2));
  • type-approved motor vehicles (Art. 2(2)), and two- or three-wheel vehicles, except pedal-assisted L1e vehicles (Delegated Regulation (EU) 2025/1535);
  • aviation products certified under EU civil aviation rules (Art. 2(3));
  • marine equipment (Art. 2(4));
  • products developed exclusively for national security or defence, or to process classified information (Art. 2(7));
  • spare parts replacing identical components (Art. 2(6)).

7. Is it one of the listed product types?

Most products are "default" products. Some are listed separately:

  • Important products, class I (Art. 7, Annex III), for example password managers, VPNs, routers and modems, operating systems, and smart home products with security functions such as locks, cameras and alarms.
  • Important products, class II, for example firewalls, intrusion detection and prevention systems, hypervisors and container runtimes.
  • Critical products (Art. 8, Annex IV): hardware devices with security boxes, smart meter gateways, smartcards and secure elements.

The category decides the conformity assessment route. Default products can use internal control (Module A). Class I can use Module A only when harmonised standards, common specifications or a "substantial" certificate are fully applied. Class II always needs a third-party route (Module B+C, Module H) or a certificate (Art. 32).

8. Is it already on the market?

The reporting duties of Art. 14 apply from 11 September 2026, and they also cover products placed on the market before 11 December 2027 (Art. 69(3)). All other obligations, such as the essential cybersecurity requirements, vulnerability handling, technical documentation and CE marking, apply from 11 December 2027 (Art. 71(2)).

What the three answers mean

  • In scope: the CRA applies, and the reporting duty applies now.
  • Out of scope: the manufacturer obligations do not apply on the facts you gave. Check again if the facts change.
  • Unclear: at least one answer falls where the text gives no clear rule. Ask a lawyer. Until then it is prudent to prepare as if the reporting duty applied.

Small companies are not exempt from reporting. Micro and small enterprises are only spared fines for missing the 24-hour early warning (Art. 64(10), as corrected on 2 July 2025).

Check your product in a few minutes

Vulnio's scope check asks these eight questions and gives you the answer with the articles behind it. It is free, needs no account and stores nothing.

This article is information, not legal advice.

Source: EUR-Lex, Regulation (EU) 2024/2847 (Cyber Resilience Act).