FREE CRA SCOPE CHECK
Does the Cyber Resilience Act apply to your product?
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) sets mandatory cybersecurity requirements for products with digital elements sold in the EU. This check tells you whether your product is likely in scope, which product class it probably falls into, and what to do first.
About 2 minutes. Your answers stay in your browser: nothing is sent or stored.
Common questions
What is the Cyber Resilience Act?
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets mandatory cybersecurity requirements for products with digital elements sold in the EU, from design to the end of the support period. It entered into force in December 2024.
Does the CRA apply to embedded and IoT products?
Usually yes. Hardware and software products with a direct or indirect data connection that are made available on the EU market are in scope. Medical devices, vehicles, civil aviation, marine equipment, defence products and pure web services are excluded or covered by other rules.
What are the CRA product classes?
Most products are in the default class and use self-assessment. Important products (Annex III, Class I and II) face a stricter route, and critical products (Annex IV) may need European certification. The class depends on the product's main function.
When do the obligations apply?
Vulnerability and incident reporting applies since 11 September 2026. The full requirements apply from 11 December 2027. Products already on the market are covered by the full requirements only if they are substantially modified.
Does this check store my answers?
No. The check runs in your browser. Your answers are not sent to a server and are not saved. We only count anonymous events such as starting or finishing the check, with the resulting scope and class.