Scope — Which Products Are Covered by the CRA?

The CRA defines a product with digital elements as any software or hardware product (and its remote data processing solutions) that:

1. Can connect — directly or indirectly — to another device or network
2. Is placed on the EU market (sold to EU customers) after the application date

• Physical hardware devices with embedded software (IoT devices, routers, industrial controllers)
• Standalone software applications (both desktop and mobile)
• Operating systems and firmware
• Software components sold as part of a larger product

Key test: Does the product have any form of network connectivity, even indirect? If yes, it is likely in scope.

Article 3 excludes products already subject to equivalent cybersecurity requirements under other EU regulations:

• Medical devices — Covered by MDR (Medical Device Regulation) and IVDR
• Motor vehicles — Covered by UNECE WP.29 and the EU type-approval framework
• Civil aviation products — Covered by EASA regulations
• Marine equipment — Covered under the Marine Equipment Directive
• Military and national security products — Excluded from EU internal market law entirely

Important: Products that partially overlap with these sectors but are not specifically regulated by sector-specific legislation may still be in scope. For example, a health and fitness tracker that is not classified as a medical device is not excluded from the CRA.

Pure Software as a Service (SaaS) and cloud services are generally not covered by the CRA. The CRA focuses on products placed on the market — i.e., products that are downloaded, installed, or shipped as physical goods.

• Software that is downloaded and installed on a device (mobile apps, desktop applications) is in scope.
• Hardware products that rely on cloud connectivity for their primary function are in scope (the hardware product, not the cloud service itself).
• If a vendor offers both a downloadable product and a cloud-hosted version, the downloadable product is likely in scope.

This distinction is important for software vendors who offer both SaaS and on-premise deployment options.

The CRA distinguishes between three roles in the supply chain:

1. Manufacturers — Companies that design, develop, and produce products, or have them designed/produced and sell them under their own name or trademark. Manufacturers bear the primary compliance obligations.

1. Importers — Companies that bring non-EU products into the EU market. Importers must verify manufacturer compliance and may bear liability if a manufacturer is unreachable.

1. Distributors — Companies that make products available on the EU market without placing them on the market themselves. Distributors have lighter obligations but must verify that products bear proper CE marking.

For global manufacturers with EU customers, the manufacturer obligations apply regardless of where the manufacturer is based.