Skip to content
AuCRA SecurityHub
Menu

Get your products ready for the CRA.

Compass shows where you stand, Insight holds the risk assessment and its evidence, and Shield runs vulnerability handling.

See the platformsTry Compass free

If it has software in it, start from yes.

Software and hardware products both count. So does a component sold on its own, and the cloud service your product needs to work.

Product with digital elements

The deviceHardware on the market

Its softwareFirmware, embedded code

Remote data processingThe cloud side

Components sold separatelyIn scope alone

Likely covered by the CRA

Answer up to five questions to see whether the CRA likely applies to your product.

Scope check
What these words mean
Product with digital elements
The law's name for a software or hardware product together with the remote data processing it needs to work. A component placed on the market on its own counts as one too.

ReferenceCRA Article 3(1)

Scope check

Open full page

All the questions and results are listed below. Start at question 1 and follow the link next to your answer.

  1. Is it software, or a device or part that stores, processes or sends data?

    Examples and legal text

    For example a phone app, a computer program, firmware, a smart plug, a laptop or a chip. Parts supplied on their own count too, such as a sensor or a software library. If people only use it online, like a website or a web app, answer Yes: the next question sorts that out.

    Legal term: “product with digital elements”, “hardware”

    Sources: CRA Art. 3(1), Art. 3(5)

    Read the FAQ answer

  2. Is it a physical device, or software that people download or install on their own device, not just use in a web browser?

    Examples and legal text

    Phone apps, desktop programs, firmware and browser extensions are a Yes. So is an app built with web technology, if it is supplied to run on the user's device. Answer No if people only reach it over the internet, for example a website or web app opened in a browser, and nothing you supply runs on their device. This follows the European Commission's guidance, which is not binding.

    Legal term: “executes on the user's electronic information system” (Commission guidance)

    Sources: CRA Art. 3(1); Commission guidance C(2026) 5252 final (non-binding)

    Read the FAQ answer

  3. Does a device or app need this online service for one of its features, and did that device or app's maker build the service, or have it built for them?

    Answer this only if you answered No to question 2.

    Examples and legal text

    For example, the cloud service a smart home device maker provides so people can control the device from afar, or a service the maker developed that its phone app needs to reach its data. A website that does not support any product feature does not count. Nor does an online service built outside the maker's responsibility: in the Commission's non-binding reading, that includes a ready-made service the maker only licenses.

    Legal term: “remote data processing”

    Sources: CRA Art. 3(1), Art. 3(2); recitals 11 and 12; Commission guidance C(2026) 5252 final (non-binding)

    Read the FAQ answer

  4. Does it connect to another device or a network to send or receive data, even indirectly, in the way you intend or in a way people could predictably use it?

    Examples and legal text

    The link can be a cable, a radio signal such as Wi-Fi or Bluetooth, or a link made in software. It also counts if it goes through something else, for example a computer the product plugs into. "The way you intend" means the use you describe in its instructions, marketing and technical documents. "A way people could predictably use it" covers uses you did not plan but that are likely, given how people behave or how it works with other technology.

    Legal term: “intended purpose”, “reasonably foreseeable use”, “direct or indirect logical or physical data connection”

    Sources: CRA Art. 2(1), Art. 3(8) to 3(10), Art. 3(23), Art. 3(24)

    Read the FAQ answer

  5. Is it supplied for sale or use in the EU as part of a business activity, whether paid or free?

    Examples and legal text

    This asks where it is supplied, not where you are based. A free product can count. The CRA's recitals list signs of business activity, such as charging more than cost for support, or making money from the product in other ways. Free open-source software counts only when its maker makes money from it.

    Legal term: “making available on the market”, “commercial activity”

    Sources: CRA Art. 2(1), Art. 3(22); recitals 15, 16 and 18

    Read the FAQ answer

  6. Is it one of the products the CRA leaves out, such as a medical device?

    See the full list

    This is the complete list. Answer Yes only if your product fully matches one item:

    1. Products covered by the EU rules on medical devices (Regulation (EU) 2017/745) or on in vitro diagnostic medical devices (Regulation (EU) 2017/746).
    2. Products covered by the EU type-approval rules for motor vehicles and their trailers (Regulation (EU) 2019/2144).
    3. Products certified under the EU civil aviation rules (Regulation (EU) 2018/1139).
    4. Equipment covered by the EU rules on marine equipment (Directive 2014/90/EU).
    5. Spare parts that replace identical parts and are made to the same specifications as the parts they replace.
    6. Products built or changed only for national security or defence, or designed specifically to process classified information.
    7. Products covered by the EU rules on two- and three-wheel vehicles and quadricycles (Regulation (EU) No 168/2013), excluded by Delegated Regulation (EU) 2025/1535. L1e vehicles designed to be pedalled are not excluded.

    In the Commission's non-binding reading, items 2 and 7 cover a part only if it is designed only for those vehicles. Being covered by another EU law does not, on its own, take a product out of the CRA.

    Legal term: “This Regulation does not apply to …”

    Sources: CRA Art. 2(2) to 2(7); Delegated Regulation (EU) 2025/1535, Art. 1; Commission guidance C(2026) 5252 final (non-binding)

    Read the FAQ answer

Your result

Likely covered by the CRA

Reporting of actively exploited vulnerabilities and severe incidents (Article 14) has applied since 11 September 2026; the essential security requirements and CE marking apply from 11 December 2027.

Find its class

Reasoning and source

From your answers, your product meets every condition and no exception applies. An online service it needs for one of its features, built by its maker or for them, is covered as part of it.

Legal term: “product with digital elements”, “remote data processing”

Sources: CRA Art. 2(1), Art. 3(1), Art. 3(2), Art. 71(2)

Likely covered along with the product it serves

Whether the CRA applies depends on the device or app that needs this service, so run the check for that product.

Find the main product's classCheck the main product
Reasoning and source

The CRA treats an online service that a product needs, built by its maker or for them, as part of that product. So this service follows the product it serves. Run the check again for that product: if the CRA likely applies to it, this service is covered with it. The rules for such a service do not reach the maker's whole network and IT systems.

Legal term: “remote data processing”

Sources: CRA Art. 3(1), Art. 3(2); recital 11

Likely outside the CRA: not a product it covers

From your answer, it is neither software nor a device or part that stores, processes or sends data.

Reasoning and source

The CRA covers software, and devices and parts that store, process or send data, together with the online services they need. Parts count even when supplied on their own. From your answer, yours is none of these, so it likely falls outside the CRA.

Legal term: “product with digital elements”, “hardware”

Sources: CRA Art. 2(1), Art. 3(1), Art. 3(5)

Likely outside the CRA: an online service not tied to a product

Check again if you start offering software that people download or install.

Reasoning and source

In the European Commission's non-binding reading, software that people only use over the internet, such as a web app opened in a browser, is not on that basis alone a product the CRA covers. From your answers, it is also not an online service that a device or app needs and that was built by or for that product's maker, so it likely falls outside the CRA. If you later offer software that runs on the user's device, such as an app or a browser extension, check again.

Legal term: “product with digital elements”, “remote data processing”

Sources: CRA Art. 3(1), Art. 3(2); recital 12; Commission guidance C(2026) 5252 final and Commission FAQ (non-binding)

Likely outside the CRA: no data connection

Check again if people could predictably connect it, even through another device.

Reasoning and source

The CRA only covers products meant to connect to a device or network to send or receive data, directly or indirectly, or likely to be used that way. From your answer, yours is not, so it likely falls outside the CRA. If a predictable use would connect it, even through something else, check again.

Legal term: “intended purpose”, “reasonably foreseeable use”, “direct or indirect logical or physical data connection”

Sources: CRA Art. 2(1), Art. 3(8) to 3(10), Art. 3(23), Art. 3(24)

Likely outside the CRA: not supplied in the EU as a business

Check again if you start supplying it in the EU or making money from it.

Reasoning and source

The CRA covers products supplied for sale or use in the EU as part of a business activity, whether paid or free. From your answer, yours is not. If you start supplying it in the EU, or start making money from it, check again.

Legal term: “making available on the market”, “commercial activity”

Sources: CRA Art. 2(1), Art. 3(22); recitals 15, 16 and 18

Likely outside the CRA: an exception applies

Each exception has conditions your product must fully meet.

Reasoning and source

From your answer, one of the exceptions in Article 2 of the CRA or in Delegated Regulation (EU) 2025/1535 applies, so your product likely falls outside the CRA. Each one has conditions: aviation products must be certified, spare parts must be identical and made to the same specifications, and national security or defence products must be built or changed only for that purpose.

Legal term: “This Regulation does not apply to …”

Sources: CRA Art. 2(2) to 2(7); Delegated Regulation (EU) 2025/1535, Art. 1

Not clear yet

Your "Not sure" answer decides the result, so the check stops here instead of guessing.

Read the FAQ answer

Read the FAQ answer

Read the FAQ answer

Read the FAQ answer

Read the FAQ answer

Read the FAQ answer

Reasoning and source

The explanation under that question and the FAQ answer linked below set out the rule to check against.

Open "Examples and legal text" under the question you were unsure about to see the rule and its source.

You were not sure about: Is it software, or a device or part that stores, processes or sends data?

Sources: CRA Art. 3(1), Art. 3(5)

You were not sure about: Is it a physical device, or software that people download or install on their own device, not just use in a web browser?

Sources: CRA Art. 3(1); Commission guidance C(2026) 5252 final (non-binding)

You were not sure about: Does a device or app need this online service for one of its features, and did that device or app's maker build the service, or have it built for them?

Sources: CRA Art. 3(1), Art. 3(2); recitals 11 and 12; Commission guidance C(2026) 5252 final (non-binding)

You were not sure about: Does it connect to another device or a network to send or receive data, even indirectly, in the way you intend or in a way people could predictably use it?

Sources: CRA Art. 2(1), Art. 3(8) to 3(10), Art. 3(23), Art. 3(24)

You were not sure about: Is it supplied for sale or use in the EU as part of a business activity, whether paid or free?

Sources: CRA Art. 2(1), Art. 3(22); recitals 15, 16 and 18

You were not sure about: Is it one of the products the CRA leaves out, such as a medical device?

Sources: CRA Art. 2(2) to 2(7); Delegated Regulation (EU) 2025/1535, Art. 1; Commission guidance C(2026) 5252 final (non-binding)

Compass, our free guided assessment for SMEs, also checks organisational maturity and reporting readiness. Try Compass free

When each part applies.

  1. 10 Dec 2024

    The law enters into force

  2. 11 Jun 2026

    Rules for notified bodies, Articles 35 to 51

  3. 11 Sep 2026

    Reporting duties apply, Article 14

  4. 11 Dec 2027

    The whole Regulation applies

    Including the essential requirements and CE marking

ReferenceCRA Article 71(2)

Three short demos.

Where you stand

AuCRA Compass

A guided initial assessment for SMEs, covering CRA scope, product classification, organisational maturity, and reporting readiness.

ENISA-informed SME assessment

  • Guided scope, classification, maturity, and reporting checks
  • Maturity heatmap and a prioritised improvement roadmap
  • Summary and detailed reports with cited guidance
Try Compass free

Build the assessment

AuCRA Insight

A collaborative CRA assessment workspace for product context, cybersecurity risks, treatment decisions, and the evidence behind them.

Draft EN 40000-1-2

  • Product context, risk criteria, and treatment decisions
  • Threat modelling, SBOMs, and evidence attachments
  • Collaborative workspaces with DOCX and PDF reports
Open AuCRA Insight

Keep products secure

AuCRA Shield

A PSIRT workspace for assessing and handling vulnerabilities, from the first report through remediation, disclosure, and closure.

Draft EN 40000-1-3

  • Vulnerability intake, triage, and assessment
  • Remediation, disclosure, and advisory workflows
  • Linked evidence and bilingual reporting documents
Open AuCRA Shield

Your tier decides who can assess it.

Everything outside the 26 named categories is default, and you can assess it yourself. The named categories are stricter: Important II and Critical products always need a notified body or a European cybersecurity certificate.

EU declaration of conformity

You can assess it yourself

You assess

  • You draw it up and sign it at every tier
  • CE marking, once conformity is shown

  1. Everything not named

    Default

    You can assess it yourself

    You can check the product yourself under internal control (module A). You may also choose a third-party procedure, or a European cybersecurity certification scheme where one is available and applicable.

  2. 19 categories

    Important I

    Self-assessment only with standards

    You can still assess it yourself, but only if you apply harmonised standards, common specifications or an EU cybersecurity certification scheme in full. Otherwise a third party has to be involved.

    Password managers, VPNs, operating systems, routers, smart locks

  3. 4 categories

    Important II

    A third party, always

    A third party is required even if you conform to the standards completely.

    Hypervisors, firewalls, IDS and IPS, tamper-resistant chips

  4. 3 categories

    Critical

    EU certification or a third party

    Where the conditions in Article 8(1) are met, you use a European cybersecurity certification scheme. Otherwise you use one of the procedures for Important II products, so a critical product never has a lighter route than Important II.

    Security boxes, smart meter gateways, secure elements

Everything not named

Default

You can assess it yourself

You can check the product yourself under internal control (module A). You may also choose a third-party procedure, or a European cybersecurity certification scheme where one is available and applicable.

Drag, or use the arrow keys.

Choose your product's core functionality to see its likely class and conformity assessment route.

Product class finder
What these words mean
Harmonised standard
A standard whose reference the EU has published in its Official Journal. Follow one and you are presumed to meet the requirements it covers.
Third party
An independent body that assesses the product instead of you assessing it yourself. The CRA calls these notified bodies.

ReferenceCRA Annexes III and IV; Implementing Regulation (EU) 2025/2392

Product class finder

Open full page

Choose the category for your product's core functionality.

Core functionality and modules

Class follows what the product is for. A product that merely includes a firewall is not therefore Important II.

The Commission's non-binding guidance says a product has only one core functionality when its conformity assessment route is decided. The same guidance classifies a module that is also made available separately by its own core functionality, and a module supplied only as part of a larger product by that product's.

Implementing Regulation (EU) 2025/2392 gives the official technical description of each category.

Important I: Annex III, 19 categories

  • Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers

  • Standalone and embedded browsers

  • Software that searches for, removes, or quarantines malicious software

  • Products with digital elements with the function of virtual private network (VPN)

  • Security information and event management (SIEM) systems

  • Public key infrastructure and digital certificate issuance software

  • Physical and virtual network interfaces

  • Routers, modems intended for the connection to the internet, and switches

  • Microprocessors with security-related functionalities

  • Microcontrollers with security-related functionalities

  • Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities

  • Smart home general purpose virtual assistants

  • Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems

  • Internet connected toys covered by Directive 2009/48/EC that have social interactive features (e.g. speaking or filming) or that have location tracking features

  • Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) 2017/746 do not apply, or personal wearable products that are intended for the use by and for children

Important II: Annex III, 4 categories

  • Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments

  • Firewalls, intrusion detection and prevention systems

Critical: Annex IV, 3 categories

  • Hardware Devices with Security Boxes

  • Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944, and other devices for advanced security purposes, including for secure cryptoprocessing

  • Smartcards or similar devices, including secure elements

Default: not listed in Annex III or IV

  • My product's core functionality is not one of the 26 named categories.

Your resultNo category chosen yetDefaultYou can assess it yourselfImportant ISelf-assessment only with standardsImportant IIA third party, alwaysCriticalEU certification or a third party

Your result

No category chosen yet

Likely class: Default

You can assess it yourself

You can check the product yourself under internal control (module A). You may also choose a third-party procedure, or a European cybersecurity certification scheme where one is available and applicable.

Compliance matrixDeclaration of conformity drafter

Likely class: Important I

Self-assessment only with standards

You can still assess it yourself, but only if you apply harmonised standards, common specifications or an EU cybersecurity certification scheme in full. Otherwise a third party has to be involved.

Free and open-source software

If your product is free and open-source software, you may also use internal control (module A), provided you make the technical documentation public when you place it on the market.

Compliance matrixDeclaration of conformity drafter

Likely class: Important II

A third party, always

A third party is required even if you conform to the standards completely.

Free and open-source software

If your product is free and open-source software, you may also use internal control (module A), provided you make the technical documentation public when you place it on the market.

Compliance matrixDeclaration of conformity drafter

Likely class: Critical

EU certification or a third party

Where the conditions in Article 8(1) are met, you use a European cybersecurity certification scheme. Otherwise you use one of the procedures for Important II products, so a critical product never has a lighter route than Important II.

Compliance matrixDeclaration of conformity drafter

Sources: CRA Art. 32; Annexes III and IV; Implementing Regulation (EU) 2025/2392

Not sure the CRA applies to your product? Start with the scope check.

Compass, our free guided assessment for SMEs, also checks organisational maturity and reporting readiness. Try Compass free

Annex I

The part you have to build.

Annex I is where the Regulation says what your product must do, and what you must keep doing about vulnerabilities while you support it.

Part I: what the product must do

These apply on the basis of your own cybersecurity risk assessment, and only where applicable. Annex I is not thirteen boxes every product ticks.

  1. aNo known exploitable vulnerabilities

    At the point it is made available on the market.

  2. bSecure by default

    Including the possibility to reset the product to its original state.

  3. cFixable by security update

    Automatic where applicable, with an opt-out and the option to postpone.

  4. dProtection from unauthorised access

    Appropriate control mechanisms, and reporting on possible unauthorised access.

  5. eConfidentiality of data

    Encrypt relevant data at rest or in transit, by state of the art mechanisms.

  6. fIntegrity of data and configuration

    Against unauthorised modification, and reporting on corruptions.

  7. gData minimisation

    Process only data that is adequate, relevant and limited to the intended purpose.

  8. hAvailability of essential functions

    Also after an incident, including against denial-of-service attacks.

  9. iNo harm to other networks

    Minimise the impact on services provided by other devices.

  10. jLimited attack surface

    Fewer ways in, including external interfaces.

  11. kExploitation mitigation

    Reduce the impact of an incident when one happens.

  12. lSecurity related logging

    Record and monitor relevant internal activity, with an opt-out.

  13. mSecure, permanent deletion

    All data and settings, and secure transfer where data can move.

Part II: what you keep doing after it ships

  1. 1Identify and document components

    A software bill of materials (SBOM) in a machine-readable format, covering at the very least the top-level dependencies.

  2. 2Fix vulnerabilities without delay

    Security fixes go out separately from functionality updates, where that is technically feasible.

  3. 3Test and review regularly

    Effective and regular security tests of the product.

  4. 4Disclose what you fixed

    Once the update is out, with enough detail for users to act.

  5. 5Run a disclosure policy

    A coordinated vulnerability disclosure policy, put in place and enforced.

  6. 6Publish a reporting contact

    An address for vulnerabilities found in the product or its components.

  7. 7Distribute updates securely

    Automatically as well, where applicable for security updates.

  8. 8Free of charge, unless otherwise agreed

    Updates carry advisory messages. The exception is a business user agreeing otherwise on a tailor-made product.

at least 5 yr

How long Part II binds

The support period. Five years, unless the product is expected to be in use for less, and longer where it is expected to be in use for longer.

2.5 % or EUR 15 M

Getting Annex I wrong

Of total worldwide annual turnover, whichever is higher.

What these words mean
SBOM
A software bill of materials: a machine-readable list of the components a product is built from. The CRA asks for the top-level dependencies at the very least, not every nested one.
Support period
The time for which you must keep handling vulnerabilities in the product. At least five years, and longer where the product is expected to be in use for longer.

ReferenceCRA Annex I Parts I and II; Articles 13(8) and 64

CHOOSE YOUR STARTING POINT

The right workspace for each part of the journey.

Choose the platform for your next task: readiness, assessment documentation, or vulnerability handling.

Understand your starting point

AuCRA Compass

ENISA-informed SME assessment

A guided initial assessment for SMEs, covering CRA scope, product classification, organisational maturity, and reporting readiness.

  • Guided scope, classification, maturity, and reporting checks
  • Maturity heatmap and a prioritised improvement roadmap
  • Summary and detailed reports with cited guidance

What you work towards

A clearer starting point and improvement priorities.

Try Compass for free

Build the assessment

AuCRA Insight

Draft EN 40000-1-2

A collaborative CRA assessment workspace for product context, cybersecurity risks, treatment decisions, and the evidence behind them.

  • Product context, risk criteria, and treatment decisions
  • Threat modelling, SBOMs, and evidence attachments
  • Collaborative workspaces with DOCX and PDF reports

What you work towards

Structured risk documentation and supporting evidence.

Open AuCRA Insight

Keep products secure

AuCRA Shield

Draft EN 40000-1-3

A PSIRT workspace for assessing and handling vulnerabilities, from the first report through remediation, disclosure, and closure.

  • Vulnerability intake, triage, and assessment
  • Remediation, disclosure, and advisory workflows
  • Linked evidence and bilingual reporting documents

What you work towards

Traceable vulnerability cases and response records.

Open AuCRA Shield

ReferenceAuCRA SecurityHub product overview

Talk to Auray about your product.

Talk to Auray

Checked against: Regulation (EU) 2024/2847 (CRA), Implementing Regulation (EU) 2025/2392, ENISA SME Cyber Resilience Maturity Model, BSI TR-03183 Parts 1-3, EN 40000 series (draft), Commission CRA Guidance & FAQ, Blue Guide 2022