Free checker

Does the CRA apply to your product?

Eight quick questions, no signup, about two minutes. A general guide to the EU Cyber Resilience Act's scope, not legal advice.

Question 1 of 8 What do you make? Software or an app that people install or run themselves (desktop, mobile, server, library, firmware) A hardware device with software in it Only an online service people use through a browser or API, where we host everything Something else, or I'm not sure

Why we ask

The Act covers hardware and software products and the remote data processing that is part of them (Art. 3(1)). A service hosted entirely by you, with nothing for users to install or run, sits outside the Act on its own (recital 12).

Question 2 of 8 Can the product connect to anything else, directly or indirectly? Think internet, local network, Bluetooth, USB, a phone app, or another device. Yes No, it is fully standalone and never connects to anything Not sure

Why we ask

The Act applies to products whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Art. 2(1)).

Question 3 of 8 Is it, or will it be, available to people or businesses in the EU? That means sold, downloaded, shipped, or supplied through a distributor or app store, including free versions. Yes, it is already Not yet, but we plan to No, only the UK or outside the EU I don't know where our customers are

Why we ask

The Act applies to products "made available on the market" in the EU, wherever you are based (Art. 2(1), Art. 3(22)). Check the article numbering against the Official Journal text.

Question 4 of 8 Is it supplied as part of a business or commercial activity? Yes: we sell it, charge a subscription, or it's part of a paid product or service Yes: it's free, but we're a business and it brings in money some other way (ads, paid support, a paid upgrade, a hosted version) No: free, open-source, no charge, and not tied to a business No: published by a not-for-profit and any income goes back into the project Not sure

Why we ask

"Making available" means supply in the course of a commercial activity, whether in return for payment or free of charge (Art. 3(22) and recitals 15–18). Recital 18 says free and open-source software not monetised by its manufacturer is not a commercial activity, and not-for-profit development generally isn't, if the organisation puts earnings into its not-for-profit objectives. Open-source stewards have a lighter set of duties (Art. 24).

Question 5 of 8 Is it already covered by one of these separate EU regimes? Medical device or in vitro diagnostic device Motor vehicle (type-approval rules) Aviation product certified under EU aviation safety rules Marine equipment (the EU Marine Equipment Directive) None of these Not sure

Why we ask

Art. 2(2) excludes products covered by Regulations (EU) 2017/745 (medical devices), 2017/746 (in vitro diagnostics) and 2019/2144 (motor vehicles). Art. 2(3) excludes products certified under Regulation (EU) 2018/1139 (aviation). Art. 2(4) excludes equipment within Directive 2014/90/EU (marine equipment). The exclusions turn on the legal regime that applies, not simply on the industry, so "Not sure" matters here.

Question 6 of 8 Was it made or changed only for national security or defence? Yes No Not sure

Why we ask

Art. 2(7) excludes products developed or modified exclusively for national security or defence purposes.

Question 7 of 8 Is it a spare part that replaces an identical component in a product that's already on the market? Yes No

Why we ask

Art. 2(6) excludes spare parts made available to replace identical components.

Question 8 of 8 Does it do any of these? Pick all that apply. Identity management or privileged access management; a browser; a password manager; antivirus or anti-malware; a VPN; network management; SIEM; a boot manager; PKI or certificate issuance An operating system; a router, modem or switch; a network interface; a microprocessor, microcontroller, ASIC or FPGA with security functions A smart-home assistant or smart-home security product (smart lock, security camera); an internet-connected toy with social features or location tracking; a wearable for health monitoring A hypervisor or container runtime; a firewall or intrusion detection/prevention system; a tamper-resistant processor or microcontroller A hardware security box, smart meter gateway, smartcard or secure element

Leave all unticked if none apply.

Why we ask

Annex III lists "important" products: Class I (for example identity management, browsers, password managers, antimalware, VPNs, network management, SIEM, boot managers, PKI, network interfaces, operating systems, routers/modems/switches, security-function chips, smart-home assistants and security products, certain toys and wearables) and Class II (hypervisors and container runtimes; firewalls and intrusion detection/prevention; tamper-resistant processors and microcontrollers). Annex IV lists "critical" products. These get stricter conformity assessment; most other products can self-assess.

(Optional, information only) When did you first make it available in the EU? Before 11 December 2027 After 11 December 2027

Why we ask

This doesn't change the result.