Applicability Check: does the Cyber Resilience Act apply to your product?
Nine questions, about three minutes. You will find out whether the Regulation applies to you, which product class is likely, whether the reporting obligation already applies to you and what to do next. No sign-up, and the result stays in your browser.
Based on Regulation (EU) 2024/2847, as of October 2026. Not legal advice.
What the check covers
The questions follow the structure of Regulation (EU) 2024/2847. If you would rather work through the assessment yourself, here are the steps with the relevant articles.
1. Product with digital elements
The Regulation covers hardware and software that can have a data connection (Article 2(1), Article 3, point (1)): the machine with its controller, the device with its app, the software you sell. A cloud service is included if the manufacturer is responsible for it and the product would lose a function without it (Article 3, point (2)). Purely online services with no product at the customer's end are not products within the meaning of the Regulation; NIS2 may apply to them instead.
2. EU market and role
The Regulation applies to products placed on the market in the EU. Manufacturers bear the main obligations (Article 13), including companies that have products made for them and market them under their own name or trademark (Article 3, point (13)). Importers and distributors are treated as manufacturers if they sell under their own trademark or substantially modify a product (Article 21). Importers (Article 19) and distributors (Article 20) have verification duties, and open-source software stewards have lighter obligations (Article 24).
3. Exclusions
Medical devices, motor vehicles, civil aviation, marine equipment, defence and identical spare parts are covered by their own rules (Article 2(2) to (7)).
4. Product class
Most products fall into the default category, with conformity assessment carried out by the manufacturer itself (Article 32). Important products under Annex III (class I and class II, Article 7) and critical products under Annex IV (Article 8) may require a notified body or certification. Implementing Regulation (EU) 2025/2392 describes the categories in more detail.
5. Reporting obligation since 11 September 2026
Manufacturers must report actively exploited vulnerabilities and severe incidents (Article 14): an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days after a corrective or mitigating measure is available. Reports go through ENISA's single reporting platform (Article 16). This obligation also applies to products already on the market (Article 69(3)). Open-source software stewards only have to report from 11 December 2027 (Article 24(3) in conjunction with Article 71(2)).
6. Everything else from 11 December 2027
The essential requirements in Annex I, technical documentation, the declaration of conformity, CE marking, a software bill of materials and a support period of, as a rule, at least five years (Article 13(8)). Products placed on the market before that date are only covered in the event of a substantial modification (Article 69(2)). From then on, the penalty regime of Article 64 also applies, with administrative fines of up to EUR 15 million or 2.5 per cent of total worldwide annual turnover.
This page provides general guidance based on the text of the Regulation and does not replace legal advice. More on the reporting obligation: The Cyber Resilience Act reporting obligation explained.
In scope? Then the reporting obligation is your first step.
CRA Response Center monitors your security mailbox, recognises important reports even at night and alerts your people by SMS and e-mail. You make the decisions; the tool records awareness, deadlines and history.