Grounded implementation guidance for legal, product, and engineering teams.
Use official CRA sources to translate obligations into owners, evidence, and shipping decisions.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this page to reach a defensible yes or no answer for each product line. The output should be a short written record covering scope, exclusions, remote data processing, operator role, whether the product is default, important, or critical, and which dates matter.
Article 2 applies to products with digital elements made available on the market when their intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.
Start with the product boundary, not the brand name. List the hardware, software, firmware, and any remote data processing solution that is designed by the manufacturer, or under the manufacturer's responsibility, and whose absence would stop one of the product's functions.
Assessment Autopilot can take EU Cyber Resilience Act, CRA Product Security and CE Marking Applicability Test from deciding whether these obligations apply in practice to a reusable workflow inside Sorena. Teams working on EU Cyber Resilience Act, CRA Product Security and CE Marking can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from EU Cyber Resilience Act, CRA Product Security and CE Marking Applicability Test and turn the guidance into owned tasks, evidence requests, and review checkpoints.
Review your current process, evidence gaps, and next steps for EU Cyber Resilience Act, CRA Product Security and CE Marking Applicability Test.
Some products are outside the CRA because other Union legislation already governs them or because Article 2 excludes them. Missing an exclusion creates wasted work and wrong declarations.
You should also record when the product is a spare part replacing an identical component made to the same specifications, or when it is developed exclusively for national security or defence purposes.
The CRA focuses on making available on the market. The Commission FAQ also clarifies that free and open source software is only in scope when it is made available on the market in the course of a commercial activity.
Testing builds and public archives need special care. The FAQ confirms that manufacturers may maintain public software archives, but users should be informed about risks linked to unsupported software.
Most CRA duties sit with manufacturers, but importers, distributors, authorised representatives, and open source software stewards also have defined obligations. You need this role map before building compliance ownership.
For reporting, the main establishment in the Union is the Member State where decisions related to the cybersecurity of the products are predominantly taken. If there is no Union main establishment, the CRA uses a fallback order based on representatives, importers, distributors, and user location.
Products whose core functionality matches Annex III are important products with digital elements. Annex IV covers critical products. The Commission FAQ stresses that integrating an important or critical component does not automatically make the whole finished product important or critical.
The dates matter. Chapter IV on notified bodies applies from 11 June 2026. Article 14 reporting applies from 11 September 2026. The broader CRA obligations apply from 11 December 2027.