Free scope check
CRA Scope Check
Six questions, about ninety seconds, no account. You get your scope verdict, your product category, and the dates that apply to you.
Status of the Commission guidance
The Commission's guidance on the scope of the Cyber Resilience Act was approved on 27 July 2026. The Communication states that the guidance will be formally adopted at a later date, when all language versions are available, and that it applies only from that moment. Formal adoption has not been confirmed. The guidance is not binding for economic operators, an authoritative interpretation of the CRA may only be given by the Court of Justice of the European Union, and its examples are not intended to replace a case-by-case assessment, which will always be necessary.
Step 1 of 6
Step 1 of 6
Is the product made available on the EU market in the course of a commercial activity?
Making available on the market means supplying a product for distribution or use on the Union market in the course of a commercial activity, whether for payment or free of charge (Article 3(22)). Where the manufacturer sits does not matter. Commercial activity is the trigger, not the licence: it covers charging a price, paid support, monetised related services, and requiring personal data.
Regulation (EU) 2024/2847, Article 2(1) and Article 3(22)
What the check covers
- Whether the product is made available on the EU market in the course of a commercial activity, under Article 3(22)
- Whether it is a product with digital elements or a remote data processing solution, under Article 3(1) and 3(2)
- Whether one of the sectoral carve-outs in Article 2(2) to 2(7) applies
- Whether the free and open source position in Article 3(48) and the steward regime in Article 24 apply
- Whether the core functionality falls in Annex III class I, Annex III class II or Annex IV
- Which obligations apply now and which apply from 11 December 2027