The most common question after a talk on the Cyber Resilience Act is not about the scope of obligations but about whether the regulation applies at all. The five questions below settle it.
1. Does the product have digital elements?
The regulation covers products with digital elements, meaning hardware or software capable of being connected, directly or indirectly, to a device or a network.
The word indirectly carries weight. A sensor with no network interface of its own that works through a gateway is in scope. So is a desktop application, if it communicates with anything at all.
A negative answer ends the analysis. A positive one leads to question two.
2. Do you place it on the EU market commercially?
What counts is the market, not where the company is established. A manufacturer outside the Union selling into Poland is covered on the same terms as a domestic supplier.
Open source software developed non-commercially stays outside the scope. The boundary is less obvious than it looks: paid support, a commercial edition or selling services around your own project can be enough to bring it in.
3. Is the product outside sectoral regulation?
The Cyber Resilience Act gives way to more specific legislation. Outside its scope are, among others:
- medical devices covered by the MDR and IVDR;
- vehicles type approved under UN R155 and R156;
- civil aviation;
- marine equipment covered by separate rules.
Products at the boundary need attention. An accessory to a medical device that is not itself a medical device remains in scope of the regulation. The same applies to an electric vehicle charger, while the vehicle itself falls under separate rules.
4. What is your role in the supply chain?
| Role | When | Primary obligation |
|---|---|---|
| Manufacturer | selling under your own brand | full conformity, documentation, reporting |
| Importer | placing a product from outside the EU | verifying the manufacturer's conformity |
| Distributor | making available on the market | checking marking and documents |
An important principle applies here: a substantial modification of the product, or selling it under your own brand, makes you the manufacturer, regardless of who physically produced the device. Acting as an integrator does not remove the obligations.
5. Which category does the product fall into?
The category determines whether self assessment suffices or a notified body has to be involved.
| Category | Examples | Conformity assessment |
|---|---|---|
| Default | sensors, simple electronics, most consumer products | self assessment |
| Important, class I | password managers, VPN, home routers, IdM systems | self assessment under a harmonised standard |
| Important, class II | firewalls, IDS/IPS, hypervisors, tamper-resistant microprocessors | third party involvement |
| Critical | security boxes, smart meter gateways, smartcards | European certification |
Most IoT devices land in the default category. This simplifies the formal path but does not lower the technical requirements. Self assessment means only that there is no external verification before launch.
Conclusions and next steps
Positive answers to questions one and two, with no sectoral exclusion under question three, mean the product is covered. The order of work then looks as follows:
- Establish the category, which determines budget and schedule.
- Check the deadlines. The vulnerability reporting duty applies from 11 September 2026, full application of the regulation from 11 December 2027.
- Produce an SBOM for one product to gauge the scale of the work.
The full set of requirements is covered in what the CRA requires from manufacturers, and preparing the reporting process in a separate article.
Doubts most often concern products sitting at the edge of sectoral regulation. In that case get in touch and we will work through the case together.
This text is informational and does not replace legal analysis for a specific product.