What counts as a product with digital elements
Article 2 covers any software or hardware product with a direct or indirect logical or physical data connection to a device or network. Indirect connection still counts, so a sensor that reaches a network only through a gateway, or firmware updated over a USB stick, is in scope. A product is covered once it is placed on the market, meaning made available to a third party in the course of a commercial activity. A purely in-house tool a company builds and uses only itself stays outside scope.
Sectors the CRA leaves to other rules
Some products are carved out because a sector-specific regime already governs their cybersecurity. Medical devices fall under the MDR and IVDR, civil aviation under the EASA regulation, and motor vehicles under the type-approval regulation. Military and national-security products are excluded under Article 2(6), including products designed to process classified information. For everything else, the CRA is the horizontal baseline.
Open source and dual use
Free and open-source software supplied outside a commercial activity sits outside scope. Monetising it, through paid support, a hosted version, or integration into a commercial product, brings it in for the entity that monetises. Open-source software stewards have a lighter regime under Article 24, so they maintain a cybersecurity and disclosure policy and cooperate with authorities while the CE marking and conformity duties rest on manufacturers. A dual-use product keeps its civilian version in scope even when a defence version also exists.
Scope follows the product and how it reaches the market, not where the maker is based. A non-EU manufacturer selling into the EU is in scope.