Does the Cyber Resilience Act apply to your product?
Four questions decide it: whether the product connects, whether it is placed on the EU market, whether a sectoral rule excludes it, and what your role is. Regulus records each answer with the article behind it.
Has a data connection to a device or networkArticle 2(1)
YesPlaced on the EU marketArticle 3(22)
YesCovered by a sectoral exclusionmedical · vehicles · aviation · marine · defence
NoYour role in the supply chainmanufacturer · importer · distributor
ManufacturerNext: classify by core function
Three steps, no calls.
- 01
Describe the product
What it is, how it connects and where it is sold. Hardware, software and remote data processing count.
- 02
Check the exclusions
Medical devices, type-approved vehicles, civil aviation, marine equipment on board and defence are out. The exclusion follows the product, not the company.
- 03
Record the decision
The scope decision is written down with its references, ready for the technical file and for anyone who asks why.
Scope in Regulus.
Data connection test
Direct or indirect, physical or logical, as Article 2(1) describes it.
Exclusions explained
Where each sectoral exclusion stops, including the borderline cases that trip people up.
Your role
Manufacturer, importer or distributor, and when an importer becomes the manufacturer.
Remote data processing
When the cloud behind a product is in scope with it, and when SaaS is NIS2 instead.
Read more about it.
Our guides on the Cyber Resilience Act, written against the adopted text.
Questions about scope.
Does the CRA apply to software?
Yes. Standalone software placed on the EU market is a product with digital elements, as is firmware and a remote data processing solution that a product needs to perform one of its functions.
Is railway equipment excluded from the CRA?
No. The sectoral exclusions cover medical devices, type-approved motor vehicles, civil aviation, marine equipment and defence products. Railway equipment is not among them.
Does the CRA apply to SaaS?
Pure software as a service is generally outside the CRA and falls under NIS2. A remote data processing solution is in scope when the product cannot perform one of its functions without it.
One file, start to finish.
Classification. Classify your product under the Cyber Resilience Act by its core function.
Annex I requirements. Track every Cyber Resilience Act essential requirement of Annex I.
Risk assessment. Build the cybersecurity risk assessment the Cyber Resilience Act requires.
Technical file. Generate the Cyber Resilience Act technical file in editable Word.
Article 14 reporting. Meet the Cyber Resilience Act reporting obligations of Article 14.
Start with your own product.
Free for manufacturers. An expert is one click away when you want one.