Sectoral exclusions
Not every connected product falls under the CRA. Where the EU already has sectoral cybersecurity rules, the Regulation steps back. The list is short, and only the Commission can extend it by delegated act.
Sectoral exclusions are the product groups that Article 2 of the CRA excludes from its scope, either because their cybersecurity is already governed by other EU legal acts or because they serve national security. The relevant sectoral rules apply to them instead.
Definition in the Regulation
Article 2(2) to (7) lists the exclusions:
- medical devices under Regulation (EU) 2017/745 and in vitro diagnostic medical devices under Regulation (EU) 2017/746
- vehicles type-approved under Regulation (EU) 2019/2144
- products certified under Regulation (EU) 2018/1139 (civil aviation)
- marine equipment under Directive 2014/90/EU
- spare parts that replace identical components and are manufactured to the same specifications (Article 2(6))
- products developed exclusively for national security or defence purposes or specifically designed to process classified information
Under Article 2(5), the Commission can, by delegated act, exclude further products in whole or in part where other Union law covers the same risks and achieves at least the same level of protection; this has not happened so far.
Not a sectoral exclusion, but outside the concept of a product: pure online services such as SaaS with no product on the user's side (recital 12) and free and open-source software that is not made available in the course of a commercial activity.
What it means for manufacturers
The exclusion applies to the product, not to the company. A medical technology manufacturer that sells administrative software or laboratory equipment without a medical purpose alongside its products under the Medical Devices Regulation (MDR) falls under the CRA with those products. A supplier whose control unit is type-approved in a vehicle, but which also sells the same module to machinery manufacturers, is a CRA manufacturer for that supply. The spare parts exclusion only applies to identical parts made to the same specification; an improved successor module is a new product. Wearables for health monitoring without MDR approval are not excluded but are important products in class I. If in doubt, the Applicability Check helps with an initial classification; the decision in an individual case remains a legal one.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Product with digital elements
- Free and open-source software
- Machinery Regulation (EU) 2023/1230
- Radio Equipment Directive (RED)