Which products are outside the scope of the CRA?

The general rule in Article 2(1) is wide. The CRA applies to products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.^[1] The exclusions that follow are specific and closed.

Three instruments displace the CRA outright under Article 2(2). Products to which the Medical Device Regulation (EU) 2017/745 applies, products to which the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 applies, and products to which the motor vehicle type-approval Regulation (EU) 2019/2144 applies.^[1]

Two more sit in their own paragraphs. Article 2(3) removes products certified in accordance with the civil aviation Regulation (EU) 2018/1139, and Article 2(4) removes equipment falling within the scope of the marine equipment Directive 2014/90/EU.^[1][4]

Article 2(7) removes products developed or modified exclusively for national security or defence purposes, and products specifically designed to process classified information. Article 2(8) adds that no obligation under the Regulation requires supplying information whose disclosure would run contrary to a Member State's essential national security, public security or defence interests.^[1]

Most published summaries of CRA scope list medical devices, vehicles, aviation and defence, then stop. Two more exclusions carry real commercial weight.

Marine equipment under Directive 2014/90/EU is a full carve-out in Article 2(4), not a partial one. A manufacturer supplying bridge, navigation or safety equipment covered by that Directive is outside the CRA for those products, and inside it for anything else it sells.^[1][4]

Spare parts are excluded by Article 2(6), and the wording is narrow enough to matter. The exclusion reaches spare parts made available on the market to replace identical components in products with digital elements, manufactured according to the same specifications as the components they are intended to replace.^[1] A replacement part that is improved, redesigned or built to a different specification does not meet that description, so a supplier treating its whole spares catalogue as out of scope is likely to be wrong about part of it.

Every sectoral exclusion in Article 2 exists because another Union instrument already imposes cybersecurity duties on the same product. Medical devices carry cybersecurity, post-market surveillance and incident reporting duties through the MDR and IVDR. Type-approved vehicles carry a cybersecurity management system obligation maintained across the vehicle lifecycle. Certified aviation products are assessed through the EASA framework.

The practical effect is single regulation rather than no regulation. A manufacturer that establishes an exclusion has answered which regime applies, not whether one does. Article 2(5) makes the logic explicit for future cases: the CRA's application to products covered by other Union rules addressing all or some of the Annex I risks may be limited or excluded, but only where that is consistent with the overall regulatory framework and where the sectoral rules achieve the same or a higher level of protection.^[1]

Commission guidance C(2026) 5252 works through borderline cases at the edges of these boundaries.^[5]

Article 2(5) empowers the Commission to adopt delegated acts under Article 61 specifying whether a limitation or exclusion is necessary, which products and rules are concerned, and the scope of any limitation.^[1] A scope determination made today is therefore a position to re-check rather than a settled fact.

One boundary is worth stating plainly because it is regularly misread as an exclusion. Free and open-source software is not excluded by Article 2. The test sits in the definition of making available on the market, which reaches supply for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge.^[2] Software supplied outside a commercial activity falls away on that definition rather than through Article 2, and Article 24 then creates a lighter regime for open-source software stewards.

Even inside Annex III, open source keeps a concession that is easy to miss. Article 32(5) lets manufacturers of products qualifying as free and open-source software that fall under the Annex III categories demonstrate conformity using an Article 32(1) procedure, which keeps internal control available.^[3]