Cyber Resilience Act Products with Digital Elements Scope

Article 3 defines a product with digital elements as a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately. The Commission FAQ lists standalone software, downloadable apps, programs, firmware, integrated circuits, motherboards, and sensors as examples that can qualify when the other scope conditions are met.

Article 2 adds the connection requirement. The product's intended purpose or reasonably foreseeable use must include a direct or indirect logical or physical data connection to a device or network. The FAQ treats indirect connections seriously: software that does not itself communicate may still be indirectly connected through the host system on which it runs.

Remote data processing is part of the product only when the Article 3(2) definition is met: processing takes place at a distance, the relevant software is designed and developed by the manufacturer or under its responsibility, and the product would not perform one of its functions without it. Recital 11 gives the useful pattern: a mobile app that needs a manufacturer-provided API or database service for one of its functions can bring that remote processing inside the product boundary.

That does not mean every hosted system behind a product is in scope as remote data processing. The CRA and Commission materials distinguish product-function software from surrounding infrastructure, general connectivity, analytics, websites that only provide information, and third-party SaaS that the manufacturer did not design or commission.

An integrated software or hardware component forms part of the product with digital elements. A remote data processing solution can also form part of the product if it meets Article 3(2). Other outside systems may remain external dependencies. The manufacturer must still assess product cybersecurity risks created by those dependencies. Article 13's specific due-diligence duty applies when integrating third-party components, including free and open-source components, into the product.

This distinction matters because a component supplier's CE marking, update practice, vulnerability history, or security evidence can support the finished-product assessment, but it does not transfer the finished-product manufacturer's CRA responsibility. The manufacturer remains responsible for the product as placed on the market.

Product labels help teams find the right facts, but they do not replace the Article 2 and Article 3 tests. For each category, draw the hardware, software, remote processing, and separately supplied component boundary before assigning a CRA class or conformity route.

The examples below show the questions that differ by product type. They do not state that every product in the category is in scope or belongs to an important or critical class.

Even where the product appears to meet the products-with-digital-elements definition, Article 2 can remove it from the CRA. The main exclusions include products covered by the EU medical device and in vitro diagnostic medical device regulations, products covered by the vehicle type-approval regulation, products certified under the civil aviation framework, marine equipment, identical spare parts made to replace components to the same specifications, and products developed or modified exclusively for national security or defence purposes. Commission Delegated Regulation (EU) 2025/1535 also excludes products within Regulation (EU) No 168/2013 for two- or three-wheel vehicles and quadricycles, except L1e category vehicles designed to pedal.

The exclusion should be documented against the specific legal basis, not a shorthand label. Some sector boundaries require a cross-check against the sector law and the exact product status, such as whether the product is actually covered or certified under the named regime.

Open-source status does not by itself decide CRA scope. The CRA focuses on whether the software is supplied for distribution or use on the Union market in the course of a commercial activity. Recitals 15, 18, and 19 draw boundaries for monetisation, donations, regular releases, repository hosting, and open-source software stewards.

For a scope record, separate the software publisher's role from the integrating manufacturer's role. A non-commercial FOSS component may remain outside the manufacturer regime for its publisher, while a manufacturer that integrates it into a commercial product still has due-diligence and vulnerability-handling duties for the finished product.

A product can be within Article 2 scope even when most CRA duties do not yet apply to it. Article 14 reporting applies from 11 September 2026. The remaining requirements generally apply from 11 December 2027.

Products placed on the market before 11 December 2027 are generally subject to the remaining requirements only if they undergo a substantial modification from that date. Article 14 reporting is expressly different: it applies to all in-scope products placed on the market before 11 December 2027. Keep the scope conclusion, placement-on-market date, reporting readiness, and later modification analysis as separate fields.

Once a product is in scope, the next question is role allocation. The CRA distinguishes manufacturer, authorised representative, importer, distributor, and other persons subject to obligations for manufacture or market availability. A company that markets a product under its own name or trademark can be the manufacturer even when another party built it.

Importers and distributors have real checks, but they are not second manufacturers by default. Importers check conformity assessment, technical documentation, CE marking, declaration of conformity, user information, and manufacturer traceability obligations before placing the product on the market. Distributors verify marking, documentation, traceability, and necessary documents before making the product available. Either role can become the manufacturer if it markets the product under its own name or substantially modifies it.