Use this CRA FAQ to determine when hardware, software, source code, and connected systems fall within CRA scope, what kinds of connections count, and which exclusions apply.
Built for product, legal, engineering, and compliance teams assessing whether an offering is a CRA product with digital elements.
Structured answer sets in this page tree.
Cited legal and guidance references.
The CRA applies only where a product with digital elements is made available on the EU market and has the required direct or indirect data connection in its intended purpose or reasonably foreseeable use. This FAQ explains the scope tests, software and firmware coverage, connection concepts, exclusions, source-code edge cases, and multi-element system boundaries.
A product is in scope when three elements are present together:
- it is a product with digital elements
- it is made available on the EU market
- its intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network
The Article 2 exclusions must then also be checked.
Article 2(1)-(7)
section 1.1
Research Copilot can turn EU Cyber Resilience Act FAQ Scope and Products with Digital Elements into a reusable cited workflow for teams implementing EU Cyber Resilience Act FAQ.
Start from EU Cyber Resilience Act FAQ Scope and Products with Digital Elements and move to source-backed decisions and evidence workflows.
Review evidence gaps, ownership, and next steps for EU Cyber Resilience Act FAQ.
A product with digital elements is a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately.
Article 3(1)
section 1.2
Yes.
The Commission FAQ expressly lists standalone software, such as downloadable mobile apps and programs, as examples of products with digital elements.
section 1.2
Article 3(1), Article 3(4)
Yes.
Firmware falls within the CRA when it is software placed on the market, including when it is supplied separately for integration into hardware devices.
section 1.2
Article 3(1), Article 3(4), Article 3(6)
Yes.
The Commission FAQ lists integrated circuits, motherboards, and sensors as examples of hardware that can be products with digital elements when the other scope conditions are met.
section 1.2
Article 3(1), Article 3(5), Article 3(6), Article 3(7)
Yes.
The draft guidance says the delivery channel does not decide the product boundary by itself. If a hardware device is designed to operate together with specific software so that it can perform its intended functions, the hardware and that software together constitute the product with digital elements even if the software is downloaded later through a separate channel such as a website or app store.
Article 3(1)
section 1.2
point 19 and Examples 3-4
No.
The product must also have a direct or indirect logical or physical data connection to a device or network in its intended purpose or reasonably foreseeable use. The Commission FAQ gives examples such as offline dishwashers, calculators, toys, coffee machines, and electric toothbrushes that are outside scope despite embedded firmware.
Article 2(1)
section 1.3
A logical connection is a virtual representation of a data connection implemented through a software interface.
The Commission FAQ gives examples such as network sockets, pipes, files, APIs, browsers establishing HTTPS sessions, and email clients initiating IMAP or SMTP exchanges.
Article 3(8)
section 1.3
A physical connection is a connection between electronic information systems or components implemented using physical means, including electrical, optical, mechanical, wired, or radio-based interfaces.
The Commission FAQ gives examples such as USB, Ethernet, fibre, copper fieldbus, Wi-Fi, Bluetooth, and NFC.
Article 3(9)
section 1.3
Yes.
The CRA expressly covers indirect logical or physical connections. The Commission FAQ explains that even products only indirectly connected through a larger system can serve as attack vectors and therefore fall within scope.
Article 2(1), Article 3(10), recital 9
section 1.3
Generally yes.
The March 2026 draft guidance says the scope boundary is not the mere presence of electronics, but the product's capacity to exchange digital information. Signals used only to power or trigger a function, without conveying digitally encoded information, do not amount to a data connection for CRA purposes.
points 23-25
Article 2(1), Article 3(7)-(10)
Not necessarily.
The Commission FAQ says websites that do not support the functionality of a product with digital elements are not themselves products with digital elements. If a website supports the functionality of a product and meets the definition of remote data processing, it may fall within scope on that basis.
section 1.2
Article 3(1), Article 3(2), recital 12
No, not by itself.
The Commission FAQ says standalone SaaS and other cloud solutions designed and developed outside the responsibility of a manufacturer of a product with digital elements are not themselves products with digital elements. Where such a service meets the definition of remote data processing for a product, it can fall within scope on that basis.
section 1.2
Article 3(2), recital 11, recital 12
Generally no.
The CRA applies to products made available on the market. The Commission FAQ relies on the Blue Guide to explain that placing on the market does not take place where a product is manufactured for one's own use.
section 1.5
section 2.3
Article 3(21), Article 3(22)
Generally no, unless they are separately placed on the market.
The Commission FAQ gives this example directly for development and configuration tools.
section 1.5
Yes, under specific conditions.
Article 4(3) allows unfinished software that does not comply with the CRA to be made available for the limited period required for testing, provided it carries a visible sign stating that it does not comply and is not being made available for purposes other than testing.
Article 4(3), recital 37
section 1.6
It can still be in scope.
The March 2026 draft guidance explains that the CRA applies based on placement on the market, not on when the product was originally designed. So a product designed before 11 December 2027 can still fall within the CRA if it is first placed on the EU market on or after 11 December 2027.
section 2.6 and Example 7
Article 2(1), Article 3(21), Article 71(2)
As a rule, only if they are substantially modified from that date onward.
Article 69(2) says products placed on the market before 11 December 2027 are subject to the CRA only if, from that date, they are substantially modified. Article 14 reporting obligations are the express exception, and the Commission FAQ says those obligations start applying on 11 September 2026.
Article 69(2)-(3)
section 1.4
No.
Those products are excluded, as are products specifically designed to process classified information.
Article 2(7)
section 1.8
No.
The Commission FAQ says dual-use products remain subject to the CRA when made available on the market unless they are developed or modified exclusively for national security or defence purposes.
section 1.8
Article 2(7)
The CRA does not apply to:
- products to which Regulation (EU) 2017/745 on medical devices applies
- products to which Regulation (EU) 2017/746 on in vitro diagnostic medical devices applies
- products to which Regulation (EU) 2019/2144 on vehicle type approval applies
- products certified in accordance with Regulation (EU) 2018/1139 on civil aviation
- equipment within the scope of Directive 2014/90/EU on marine equipment
Article 2(2)-(4)
section 1.9
Yes.
The Commission FAQ says Delegated Regulation (EU) 2025/1535 also excludes products with digital elements falling within the scope of Regulation (EU) No 168/2013 on two- or three-wheel vehicles and quadricycles, except L1e category vehicles designed to pedal.
section 1.9
Yes.
Article 2(5) allows the Commission to adopt delegated acts limiting or excluding the CRA for products covered by other Union rules that address all or some of the same risks, where the regulatory framework remains coherent and the sectoral rules achieve the same or a higher level of protection.
Article 2(5)
Yes.
The CRA excludes spare parts made available to replace identical components in products with digital elements where those spare parts are manufactured according to the same specifications as the components they replace.
Article 2(6)
Yes.
The CRA does not prevent Member States from setting additional cybersecurity requirements for procurement or use for specific purposes, including national security or defence procurement or use, as long as those requirements are consistent with Union law and are necessary and proportionate.
Article 5(1)
section 1.8
Yes.
The draft guidance says it does not matter whether the code is uncompiled, compiled, or interpreted. If a manufacturer provides computer code to customers as part of a commercial activity, that code is placed on the market for CRA purposes even if the customer still has to adapt or compile it before use.
points 20 to 22, Example 5
Article 3(4)
No.
The draft guidance says public sharing of free and open-source computer code in repositories is not by itself placing that code on the market. It also says unfinished code shared during design and development, and sample or demo code provided in tutorials or training materials, is not considered placed on the market.
point 21
Article 3(22), Article 4(3)
Yes.
The Commission FAQ gives the example of an offline text editor or calculator that does not itself initiate communications but runs on a host operating system that does. In that situation, the software can still be indirectly connected within the CRA meaning.
section 1.3
Article 3(10), recital 9
Not by itself.
The draft guidance says a data connection requires digital information to be deliberately encoded and capable of being decoded as data at the destination. Signals used only to power or trigger a function do not create a CRA data connection. The Commission FAQ's electric-toothbrush example illustrates the same boundary.
points 23 to 25
section 1.3
Article 2(1), Article 3(7) to Article 3(10)
Yes.
The draft guidance says systems composed of multiple hardware and software elements that operate together to perform a certain function can be a single product with digital elements where that system is placed on the market as a single product. Their complexity, long lifecycle, or reliance on older components does not exclude them from scope by itself.
points 26 to 29
Article 3(1), Article 13(3)