Does the Cyber Resilience Act apply to you?
Five quick questions give you an indicative read on your CRA scope, the deadlines that matter for you, and where to start. Most machine builders are in scope, but not for everything at once, and not all on the same date.
- Does your product contain software or firmware?
- Do you place it on the EU market?
- Can it connect to a network or another device?
- Do you also supply software or components to other manufacturers?
- Does any part perform a safety function?
Indicative only — not legal advice. It highlights likely scope and which obligations to prepare for; confirm your product classification (default vs important/critical) before you act.
How CRA scope works (in plain terms)
The Cyber Resilience Act covers "products with digital elements" (anything with software or firmware) that are placed on the EU market. It is extraterritorial: it applies to non-EU manufacturers who sell into the EU, and importers and distributors carry duties too.
Being in scope does not all land at once. Article 14 incident reporting begins on 11 September 2026 and applies even to products already in the field. The broader Article 13 / Annex I duties (SBOM, secure-by-design, vulnerability handling, technical documentation, CE marking) apply from 11 December 2027.
Around 90% of products fall in the default class, where the manufacturer self-assesses. "Important" and "critical" classes face stricter conformity assessment. This check indicates likely scope and your timeline; it does not classify your product or constitute legal advice.
Indicative only — not legal advice. It highlights likely scope and which obligations to prepare for; confirm your product classification (default vs important/critical) before you act.