Ask five questions: is it a product with digital elements, is it connected, is it made available on the EU market in the course of a commercial activity, does an exclusion apply, and what is your role. The answers can differ per product and per component.
The five scope questions
| Question | CRA reference |
|---|---|
| Is it software or hardware, or its remote data processing solution? | Article 3(1), 3(2) |
| Does its intended purpose or reasonably foreseeable use include a direct or indirect logical or physical data connection to a device or network? | Article 2(1), Article 3(8) to 3(10) |
| Is it made available on the EU market in the course of a commercial activity, with or without payment? | Article 3(21), 3(22) |
| Is it excluded: medical devices, motor vehicles, certified aviation products, marine equipment, spare parts, national security and defence? | Article 2(2) to 2(7) |
| What is your role: manufacturer, importer, distributor, open-source software steward? | Article 3(13), 3(14), 3(16), 3(17) |
Remote data processing
Remote data processing is part of the product when the software is designed and developed by the manufacturer, or under its responsibility, and its absence would prevent the product from performing one of its functions (Article 3(2)). A mobile app that depends on a vendor cloud service for a core function is assessed together with that service.
Open-source software
Only free and open-source software made available on the market, supplied in the course of a commercial activity, is in scope. The Commission states that supplying open-source software without monetisation is not a commercial activity. Open-source software stewards have a lighter set of obligations (Article 24).
Roles
A manufacturer develops or manufactures products, or has them designed, developed or manufactured, and markets them under its own name or trademark (Article 3(13)). An importer places on the market a product bearing the name or trademark of a person established outside the Union (Article 3(16)). A distributor makes a product available without affecting its properties (Article 3(17)).
A questionnaire cannot give a definitive legal determination. Borderline cases need a case-specific review.
We help manufacturers turn this requirement into a process and evidence.
Related guidance
- Cyber Resilience Act (CRA): what it is and what it requires
- CRA timeline: what applies in 2026 and 2027
This guidance explains the regulation and gives practical recommendations. It is not legal advice. Regulatory facts and recommendations are labelled separately. See our editorial policy (Slovenian): editorial policy.