Does the CRA Apply to Your Product? Applicability Guide

The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for products with digital elements placed on the EU market. One of the most important questions companies face before December 2027 is: does the CRA apply to our product?

This guide provides a deep, expert-level analysis of CRA applicability, including how “products with digital elements” are defined, what exclusions exist, which edge cases matter, and how products are classified as default, important or critical.

If you need a quick evaluation, start with our CRA Applicability Checker.

Table of Contents

Free download: our CRA checklist, from scope to CE marking, in one PDF.

What Counts as a “Product With Digital Elements” Under the CRA?

The CRA applies to any Product with Digital Elements (PDE). This is a foundational definition and includes:

Software (local, installable, on-device, or distributed binaries)
Firmware (for hardware modules, chips, controllers, sensors)
Connected hardware (consumer or industrial)
IoT devices (smart home, industrial IoT, wearables, mobility devices)
Embedded systems (MCUs, PLCs, automotive subsystems not regulated elsewhere)
Hardware modules that interact with networks or run software

The test is straightforward: If the product includes software or firmware and can connect, directly or indirectly, to another device or a network, it is almost always in scope.

Source: European Commission

In Regulus, free for manufacturers: check whether the CRA applies to your product, with the article behind each answer.

Real-World Examples of Products In Scope

Software (installable packages)

Desktop applications (Windows, macOS, Linux)
Installable agents and clients for cloud services
Security software, VPN clients, development tools

IoT Devices

Smart home devices
Connected industrial sensors
Wearables, trackers, consumer electronics

Embedded systems and firmware-driven hardware

Gateways, hubs, routers
Microcontroller-driven devices
Automated machinery components

Physical hardware with digital functions

Robotics components
Medical-device-adjacent equipment (if not regulated separately)
Smart appliances

Products Not Covered by the CRA

Some categories are explicitly excluded:

Pure SaaS without installables or on-device components
Products regulated under sector-specific legislation (e.g., medical devices under the MDR and IVDR, vehicles and components type-approved under Regulation (EU) 2019/2144, civil aviation, marine equipment). The exclusion covers the regulated finished product, not everything a company sells to that sector
Open-source software developed outside commercial activity
Products exclusively for national security, military or intelligence use

To understand whether your software counts as SaaS-only or “software with distributed components”, follow our guide: CRA Readiness Checklist.

Is your product Class I, Class II or default?

Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.

Classify your product free

CRA Applicability Decision Model

A simplified high-level model:

Is your product placed on the EU market?
    |
    +-- No → CRA does not apply
    |
    +-- Yes →
         Is it a product with digital elements?
              |
              +-- No → CRA does not apply
              |
              +-- Yes →
                    Does it fit a sector-specific exclusion?
                         |
                         +-- Yes → CRA does not apply
                         |
                         +-- No → CRA applies

Once confirmed as in scope, classification becomes the next step.

Default, Important and Critical: Applicability of Classification

All CRA products fall into one of four categories:

Default Class — standard digital product risk
Important Class I and Class II — products whose core function is listed in Annex III
Critical — the three product categories listed in Annex IV

The four product classes under the Cyber Resilience Act.

Default Class

Most products fall here. Typical examples:

Most consumer IoT devices (smart plugs, lighting, appliances)
Developer tools and software
Productivity applications
Embedded consumer devices

Important and Critical Classes

The test is the product’s core function, checked against closed lists:

Class I (Annex III): security-related software such as password managers, VPNs, anti-malware and operating systems; routers, modems and switches; smart home security products such as locks and cameras
Class II (Annex III): firewalls, intrusion detection and prevention systems, hypervisors and container runtimes, tamper-resistant microcontrollers
Critical (Annex IV): hardware devices with security boxes, smart meter gateways, smartcards and secure elements
Being used in industrial automation or critical infrastructure does not by itself raise the class: a PLC or a protocol gateway is not listed, unless its core function is one of the above (a router, a VPN, a firewall)

See the full mapping here: CRA Applicability & Classification.

Economic Operator Applicability

The CRA applies to all economic operators:

Manufacturers

They carry primary responsibility for compliance, documentation, vulnerability management, and secure development.

Importers

Must verify CRA conformity before placing the product on the EU market.

Distributors

Must confirm documentation and compliance before making the product available.

Operators are defined according to the New Legislative Framework (NLF).

Special Applicability Cases (Important)

Does the CRA apply to libraries and SDKs?

Yes — if they are distributed commercially or embedded into products placed on the EU market.

Does the CRA apply to developer tools?

Yes, unless exclusively used internally and never placed on the market.

Does the CRA apply to cloud-connected devices?

Yes. Even if the cloud is SaaS, the device and its firmware are PDEs and therefore regulated.

Does the CRA apply to mobile apps?

Yes, because they are software placed on the EU market that connects to devices and networks.

Does the CRA apply to web apps?

Only if they include installable components, local agents, drivers or distributed executables.

Checklist: How to Evaluate Whether the CRA Applies

You can use the following checklist to self-assess:

Does your product include software or firmware?
Can it connect, directly or indirectly, to another device or a network?
Is it supplied in the course of a commercial activity?
Is it offered to customers in the EU?
Is it a component for someone else’s product (OEM, ODM, integration)? Components placed on the market separately are in scope too.
Is its core function listed in Annex III or IV? This decides its class, not whether the CRA applies.
Does a sectoral exclusion cover the finished product (medical devices, type-approved vehicles, civil aviation, marine equipment, defence)?

If the answers to the first four are “yes” and no exclusion covers the product, the CRA applies.

How to Evaluate CRA Applicability Automatically

To simplify classification and applicability analysis, you can use our automated tool:

➡ Try the CRA Applicability Checker

It helps identify:

Product category
Default, important (Class I or II) or critical class
Manufacturer / importer / distributor role
Documentation implications
Next steps for compliance

External Resources

Conclusion

The Cyber Resilience Act marks a major shift in cybersecurity regulation for digital products. Understanding whether the CRA applies to your product is the first and most critical step in building a compliance strategy before full application on 11 December 2027.

To continue your preparation, explore: Cyber Resilience Act Resources.

Starting early is the easiest way to reduce risk and cost.

Once CRA applicability is clear, the next step is to plan implementation. Our Cyber Resilience Act compliance roadmap explains how to move from analysis to execution.