Cyber Resilience Act · Product and role

Does the CRA cover your product?

From connected components to software: work through the key criteria and identify what your team should assess next.

Step 1

What do your customers receive?

Assess one specific offering. If you have both a cloud version and an installable app, assess each separately.

A device or componentFor example a sensor, controller, machine or connected device, including embedded software.Software customers run themselvesFor example a desktop/mobile app, browser extension, on-premises container or separately supplied SDK.Only access to a hosted serviceFor example a browser-based CRM or GRC platform, a hosted API or a hosted MCP endpoint. No additional software download.None of theseFor example consulting without devices, software or a product backend.Not yet clear

Preliminary guidance for a specific offering. Not a conformity assessment or binding legal classification. Checked: 20 October 2026.

From assessment to action

Once product scope is clear, you need responsibilities, product information and working vulnerability handling. Our article explains the CRA reporting process already in force.

Understand CRA reporting

Does the CRA cover your product?

What do your customers receive?

From assessment to action

Sources behind the assessment