CRA Updates
Join the community

Article 14 reporting obligations have applied since 11 September 2026. Next: Full application, 11 Dec 2027.

Full timeline
Auf Deutsch

Does the Cyber Resilience Act apply to your product?

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to hardware and software products that can connect to a device or network and are made available on the EU market as part of a commercial activity, unless sector rules such as the medical device or vehicle regulations already cover them. Most in-scope products sit in the default category and can be self-assessed; products whose core function is listed in Annex III or IV face stricter conformity assessment.

A plain-English self-check, not legal advice and not a conformity assessment. The category lists below are quoted from the regulation: Official text on EUR-Lex.

Question 1 of up to 5

Can your product connect to a device or network?

Directly or indirectly, logically or physically, in its intended purpose or any reasonably foreseeable use. A USB port, a Bluetooth radio, a network stack or an update mechanism all count. Most software and almost all electronics do.

Who the Cyber Resilience Act applies to

The regulation covers products with digital elements: software or hardware, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1)). That takes in apps, desktop and embedded software, libraries sold as components, and nearly every connected device.

It applies when a product is made available on the EU market in the course of a commercial activity, whether for payment or free of charge. For free and open-source software the test is monetisation: a project its developers do not monetise is outside the regulation, while a foundation, company or other legal person that supports open-source software intended for commercial use, without monetising it itself, is an open-source software steward, with a lighter set of obligations of its own (Article 24).

A hosted service on its own is not in scope; NIS2 covers cloud computing services. But a remote data processing solution — a backend the manufacturer is responsible for, without which a product it ships could not perform one of its functions — is part of that product and in scope with it.

The regulation does not apply to:

  • products covered by the medical device, in vitro diagnostic or vehicle type-approval regulations (Article 2(2));
  • products certified under the EU civil aviation regulation (Article 2(3));
  • equipment within the Marine Equipment Directive (Article 2(4));
  • identical spare parts made to the same specifications (Article 2(6));
  • products developed or modified exclusively for national security or defence, or designed to process classified information (Article 2(7)).

Important and critical product categories

A product’s class is decided by its core functionality, not by what it contains: integrating an important product into something else does not by itself make the result important (Article 7(1)). Anything not listed below is in the default category. FOSSA’s guide to CRA product classification (on fossa.com, opens in a new tab) works through borderline cases.

The Commission set out a technical description of each category in Implementing Regulation (EU) 2025/2392 (Article 7(4)). Where a product sits near a boundary, check it against those descriptions rather than the short names here. “Default” is this site’s label for everything not listed; the regulation has no name for it.

Critical products (Annex IV)

  1. Hardware Devices with Security BoxesAnnex IV, point 1
  2. Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council and other devices for advanced security purposes, including for secure cryptoprocessingAnnex IV, point 2
  3. Smartcards or similar devices, including secure elementsAnnex IV, point 3

Important products, Class II (Annex III)

  1. Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environmentsAnnex III, Class II, point 1
  2. Firewalls, intrusion detection and prevention systemsAnnex III, Class II, point 2
  3. Tamper-resistant microprocessorsAnnex III, Class II, point 3
  4. Tamper-resistant microcontrollersAnnex III, Class II, point 4

Important products, Class I (Annex III)

  1. Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readersAnnex III, Class I, point 1
  2. Standalone and embedded browsersAnnex III, Class I, point 2
  3. Password managersAnnex III, Class I, point 3
  4. Software that searches for, removes, or quarantines malicious softwareAnnex III, Class I, point 4
  5. Products with digital elements with the function of virtual private network (VPN)Annex III, Class I, point 5
  6. Network management systemsAnnex III, Class I, point 6
  7. Security information and event management (SIEM) systemsAnnex III, Class I, point 7
  8. Boot managersAnnex III, Class I, point 8
  9. Public key infrastructure and digital certificate issuance softwareAnnex III, Class I, point 9
  10. Physical and virtual network interfacesAnnex III, Class I, point 10
  11. Operating systemsAnnex III, Class I, point 11
  12. Routers, modems intended for the connection to the internet, and switchesAnnex III, Class I, point 12
  13. Microprocessors with security-related functionalitiesAnnex III, Class I, point 13
  14. Microcontrollers with security-related functionalitiesAnnex III, Class I, point 14
  15. Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalitiesAnnex III, Class I, point 15
  16. Smart home general purpose virtual assistantsAnnex III, Class I, point 16
  17. Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systemsAnnex III, Class I, point 17
  18. Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking featuresAnnex III, Class I, point 18
  19. Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for childrenAnnex III, Class I, point 19

Conformity assessment by class

The class determines how the manufacturer demonstrates that the product meets the essential cybersecurity requirements (Article 32). Whether a notified body is needed is the practical difference.

ClassRoutes available
DefaultInternal control (module A) by the manufacturer. Third-party routes are optional.
Important, Class IInternal control only where harmonised standards, common specifications or a European cybersecurity certification scheme (assurance level at least ‘substantial’) are applied in full. Otherwise a notified body: module B then C, or module H.
Important, Class IIA notified body (module B then C, or module H), or a European cybersecurity certification scheme at assurance level ‘substantial’ or higher where one is available.
CriticalEuropean cybersecurity certification where a delegated act under Article 8(1) requires it; until then, the Class II routes.

Free and open-source software in an Annex III category may use internal control, provided its technical documentation is made public when it is placed on the market (Article 32(5)).

Common questions

Does the Cyber Resilience Act apply to SaaS?

Not to a hosted service on its own. It does apply to the cloud backend of a product you ship, where the product cannot perform one of its functions without it. That backend is assessed as part of the product.

Does it apply to open-source software?

Only when it is supplied as part of a commercial activity, which for open source turns on monetisation. Manufacturers who build unmonetised open-source components into their own products are still responsible for due diligence over them.

When does the Cyber Resilience Act apply?

It entered into force on 10 December 2024. The Article 14 reporting obligations have applied since 11 September 2026, and every other obligation applies from 11 December 2027.

What about products already on the market?

The reporting obligations for actively exploited vulnerabilities and severe incidents have applied to them since 11 September 2026. The other requirements apply per unit: every unit placed on the market from 11 December 2027 must meet them, even if the model launched earlier. Units placed on the market before that date are caught only if substantially modified after it. See the CRA timeline.

My product contains a Class I component. Is it a Class I product?

Not for that reason alone. The class follows the product’s own core function, so a smart appliance with an embedded browser is not a browser.

Next step, from FOSSA, who fund CRA Updates

Know the class? Check readiness

A free assessment that runs in your browser and scores a product against the Annex I requirements, with a 30/60/90-day plan at the end.

FOSSA CRA readiness assessment (on fossa.com, opens in a new tab)

Community

A product that doesn’t fit neatly?

Ask manufacturers and practitioners who have classified similar products.

Ask the community