CRA applicability test for products with digital elements

Start by identifying the actual product boundary. The CRA covers software or hardware products, their remote data processing solutions, and software or hardware components that are placed on the market separately.

Do not stop at the device casing or the app name. A single CRA product can include hardware, embedded firmware, separately downloaded software, and manufacturer-controlled remote processing where those elements operate together to perform product functions.

Article 2 applies where the product's intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. The presence of electronics or firmware alone is not enough if the product does not exchange digital data.

For software, indirect connection can still matter. Commission FAQ examples include software that does not initiate communications itself but runs on a host operating system that connects to a network.

The CRA scope test also asks whether the product is supplied for distribution or use on the EU market in the course of a commercial activity. Products made only for the manufacturer's own use are generally not placed on the market.

Open-source status does not decide the answer by itself. Free and open-source software is assessed by asking whether it is supplied on the Union market in commercial activity; hosting code on an open repository or package manager does not, by itself, make it available on the market.

Check exclusions before investing in conformity planning. Article 2 removes several product groups where other Union regimes apply or where the product is made for specific national security, defence, or classified-information purposes.

A product is not excluded merely because it can be used in a defence context. The grounded CRA question is whether it was developed or modified exclusively for national security or defence purposes, or specifically designed to process classified information.

Applicability is also role-specific. The CRA distinguishes manufacturers, authorised representatives, importers, distributors, other economic operators, and open-source software stewards. The same company can have different roles for different products or sales channels.

The manufacturer role is broader than physical production. A business can be the manufacturer when it develops or has a product developed and markets it under its own name or trademark. Importers and distributors can also become manufacturers if they place the product on the market under their own name or trademark, or substantially modify it.

Remote data processing is in scope only when the processing is at a distance, its absence would prevent the product from performing one of its functions, and the software is designed and developed by the manufacturer or under the manufacturer's responsibility.

This does not automatically pull an entire cloud estate into the CRA product. The grounded boundary is the software parts that directly support product functions, not the manufacturer's network and information systems as a whole.

Once the product appears in scope, classification determines the conformity assessment route. Products with the core functionality of an Annex III category are important products; products with the core functionality of an Annex IV category are critical products.

The classification test is based on actual features and technical capabilities reflected in the product's intended purpose. Integrating an important or critical component does not automatically make the whole product important or critical.

The page output should be a short scoping record that a product, security, legal, or compliance team can reuse when conformity assessment, technical documentation, supplier due diligence, and release planning begin.

If any answer depends on facts not yet known, mark the product as unresolved rather than forcing an in-scope or out-of-scope answer.