Does the CRA apply to you? Five questions

This guide takes you through the check in five questions. The examples come from industry. For an overview of duties and deadlines, see the guide for software makers.

The check in five questions

Is it a product with digital elements? This means software or hardware products with their remote data processing, including components sold separately (Art. 3(1)).
Is there a data connection? The intended purpose or foreseeable use includes a logical or physical connection to a device or network (Art. 2(1)).
Does it reach the market? You supply it in the course of a commercial activity, whether for payment or free of charge (Art. 3(22)).
Does an exemption apply? Certain products are subject to their own rules and are excluded (Art. 2(2) to (7)).
What is your role? Manufacturer, importer or distributor? Your duties depend on it (Art. 13, 19, 20).

If the answer to the first three questions is yes and to the fourth no, the CRA applies to you. The next step is the product class.

What counts as a product

The Commission guidance of 27 July 2026 (C(2026) 5252, paragraph 18) names four groups:

Standalone software. Programs and apps, whether delivered by download or on a physical medium.
Hardware with embedded software. For example connected devices and controllers with firmware.
Standalone hardware. For example integrated circuits and motherboards.
Combinations. Hardware and software supplied separately but intended to work together.

Software needed to operate, configure or control a product is part of it, even if it comes through a different channel (paragraph 25). That can include an engineering tool you offer as a download for your device.

When there is a data connection

What counts is not whether a product contains electronics, but whether it can exchange digital information. A sender deliberately encodes data, and a receiver reads it (paragraphs 26 to 28).

An output that only switches or supplies power is therefore not a data connection. A fieldbus, Ethernet, USB or a radio interface generally is. Indirect connections count too, for example through an upstream gateway.

Cloud and remote processing

Web applications that users only open in a browser are not, on that basis alone, a product under the CRA (paragraph 21). They may, however, fall under NIS2.

Remote data processing is different (Art. 3(2)). It is part of the product if two points apply:

Own development. The manufacturer develops the software for it, or has it developed under its responsibility.
Needed for a function. Without the processing, the product could not perform one of its functions.

The guidance gives the example of an industrial robot whose cloud service calculates the grip position from camera images: this service is part of the product. Telemetry purely for statistics or product development is not (paragraph 192 and section 8.3.4).

Typical cases from industry

The table shows typical classifications. It does not replace checking your product.

Case	Classification	Reason
Controller with an Ethernet interface	In scope	Hardware with software and a data connection
Engineering software that you sell	In scope	Standalone software running on the user's side
Router or switch for industry	In scope, important product of class I	Annex III class I no. 12
Industrial firewall	In scope, important product of class II	Annex III class II no. 2
Machine with a networked controller	May be in scope, plus the Machinery Regulation	Commission FAQ, section 2.4
Sensor with a plain switching output	Generally not in scope	No encoded data (paragraph 28)
Pure browser application	Not in scope on that basis alone	Paragraph 21
Identical spare part	Not in scope	Art. 2(6)
Own development or configuration tool, used internally only	Not in scope	Own use is not placing on the market (Commission FAQ, section 1.5)

The exemptions

Art. 2 excludes certain products:

Medical devices. Products under Regulations (EU) 2017/745 and 2017/746.
Vehicles. Products under Regulation (EU) 2019/2144.
Aviation. Products certified under Regulation (EU) 2018/1139.
Marine equipment. Equipment within the scope of Directive 2014/90/EU.
Identical spare parts. Parts that replace identical components and are made to the same specifications.
National security and defence. Products developed or modified exclusively for these purposes.

A spare part need not be the same in the narrow sense. What matters is that the properties relevant to cybersecurity do not change (guidance, examples 37 and 38).

What your role is

Manufacturer. You develop or make the product, or have it developed, and market it under your own name. The full duties apply to you.
Importer. You place a product from a manufacturer outside the Union on the market and ensure, among other things, that conformity assessment, documentation and CE marking are in place (Art. 19).
Distributor. You make the product available without changing it and check, among other things, the CE marking and documents (Art. 20).
Integrator. If you assemble components into a new product and place it on the market, you are its manufacturer (paragraph 120).

Two cases are often overlooked: your own brand or a substantial modification turns importers and distributors into manufacturers (Art. 21). Anyone else who substantially modifies a product and makes it available becomes the manufacturer for the affected part (Art. 22).

The product class

The class decides the route of conformity assessment. It depends on the product's core functionality. An integrated component does not automatically pull the whole product into a higher class (Art. 7(1)).

Class	Examples	Procedure (Art. 32)
Default product	Most controllers and applications	Self-assessment (module A) possible
Important, class I	Routers, switches, VPN, operating systems	Module A only with full application of harmonised standards, common specifications or a suitable certification scheme, otherwise modules B and C or H
Important, class II	Firewalls, intrusion detection systems, hypervisors	Modules B and C, module H or a certification scheme
Critical	Smart meter gateways, smartcards	Certification scheme under Art. 8, otherwise the class II procedures

Products already on the market

Placed on the market before 11 December 2027. The Art. 14 reporting duties apply. The other requirements apply only after a substantial modification from that date (Art. 69).
Placed on the market from 11 December 2027. All duties apply. Placing on the market refers to the individual unit, not to the product line (paragraph 11).
Older type, new units. A redesign is not automatically required. You still need the risk assessment, conformity assessment, declaration and CE marking (paragraphs 33 to 36).

If you are a supplier

The CRA can reach you even without an end product. A component that you place on the market separately is itself a product with digital elements (Art. 3(1)).

If you only supply parts without digital elements, requirements are more likely to come by contract: manufacturers must exercise due diligence with purchased components (Art. 13(5)). So expect questions about SBOMs, updates and vulnerability reporting.

The check in Complass

A spreadsheet records the decision, but not how you got there. Complass takes you from the first assessment to a file per product:

Applicability check. The free check on our website gives you a first assessment of the CRA, NIS2 and the Machinery Regulation, without sign-up.
Roadmap in the portal. The check in the portal saves the result with reasons and references. From it, you create a project for each CRA product and machine.
Guided CRA project. For each product, ten phases lead from applicability and role to the declaration of conformity.
Templates. Document templates cover applicability, role and product class.
Product file. A wizard asks for type, CRA classification, class, Machinery Regulation and purpose. For important class II and critical products, the version does not allow module A.

The assessment remains an assessment. You make the decision.

Checklist

All products, firmware versions and software you sell are listed.
The data connection is described for each product.
Cloud functions are checked: needed for a function, developed in-house?
Exemptions are justified with a reference.
The role per product and market is recorded.
Own brands and substantial modifications are captured.
The class is determined by the core functionality.
Products already on the market are planned in for the reporting duty.
The decision is dated, justified and approved.

Frequently asked questions

We build one-off special machines. Does the CRA still apply?

Quantity alone does not exclude the CRA. Placing on the market refers to the individual product, whether made as a single unit or in series (paragraph 11). If the machine has digital elements with a data connection, check the CRA alongside the Machinery Regulation.

Is the Machinery Regulation enough if the machine meets it?

No. The Commission makes clear that meeting one regulation does not automatically cover the other. Similar risks can, however, be addressed together and supported by a risk assessment (Commission FAQ, section 2.4).

We build a plant only for our own production. Does the CRA apply?

Products made for your own use are not placed on the market and are not in scope (Commission FAQ, section 1.5). This no longer holds once you sell them as a product of your own.

Does the CRA apply if we are based outside the EU?

Yes, if your product is made available on the EU market. Where the manufacturer is based does not decide the scope.

The free applicability check gives you a first assessment. In a demo, we show how it becomes a project for each product.

Request a demo Try it for 14 days

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The Commission's guidance and FAQ are not binding.

Does the CRA apply to me? Checking products with digital elements