Scope check
All the questions and results are listed below. Start at question 1 and follow the link next to your answer.
Is it software, or a device or part that stores, processes or sends data?
- Yes Go to question 2
- No Result: Likely outside the CRA: not a product it covers
- Not sure Result: Not clear yet
Examples and legal text
For example a phone app, a computer program, firmware, a smart plug, a laptop or a chip. Parts supplied on their own count too, such as a sensor or a software library. If people only use it online, like a website or a web app, answer Yes: the next question sorts that out.
Legal term: “product with digital elements”, “hardware”
Sources: CRA Art. 3(1), Art. 3(5)
Is it a physical device, or software that people download or install on their own device, not just use in a web browser?
- Yes Go to question 4
- No Go to question 3
- Not sure Result: Not clear yet
Examples and legal text
Phone apps, desktop programs, firmware and browser extensions are a Yes. So is an app built with web technology, if it is supplied to run on the user's device. Answer No if people only reach it over the internet, for example a website or web app opened in a browser, and nothing you supply runs on their device. This follows the European Commission's guidance, which is not binding.
Legal term: “executes on the user's electronic information system” (Commission guidance)
Sources: CRA Art. 3(1); Commission guidance C(2026) 5252 final (non-binding)
Does a device or app need this online service for one of its features, and did that device or app's maker build the service, or have it built for them?
Answer this only if you answered No to question 2.
- Yes Result: Likely covered along with the product it serves
- No Result: Likely outside the CRA: an online service not tied to a product
- Not sure Result: Not clear yet
Examples and legal text
For example, the cloud service a smart home device maker provides so people can control the device from afar, or a service the maker developed that its phone app needs to reach its data. A website that does not support any product feature does not count. Nor does an online service built outside the maker's responsibility: in the Commission's non-binding reading, that includes a ready-made service the maker only licenses.
Legal term: “remote data processing”
Sources: CRA Art. 3(1), Art. 3(2); recitals 11 and 12; Commission guidance C(2026) 5252 final (non-binding)
Does it connect to another device or a network to send or receive data, even indirectly, in the way you intend or in a way people could predictably use it?
- Yes Go to question 5
- No Result: Likely outside the CRA: no data connection
- Not sure Result: Not clear yet
Examples and legal text
The link can be a cable, a radio signal such as Wi-Fi or Bluetooth, or a link made in software. It also counts if it goes through something else, for example a computer the product plugs into. "The way you intend" means the use you describe in its instructions, marketing and technical documents. "A way people could predictably use it" covers uses you did not plan but that are likely, given how people behave or how it works with other technology.
Legal term: “intended purpose”, “reasonably foreseeable use”, “direct or indirect logical or physical data connection”
Sources: CRA Art. 2(1), Art. 3(8) to 3(10), Art. 3(23), Art. 3(24)
Is it supplied for sale or use in the EU as part of a business activity, whether paid or free?
- Yes Go to question 6
- No Result: Likely outside the CRA: not supplied in the EU as a business
- Not sure Result: Not clear yet
Examples and legal text
This asks where it is supplied, not where you are based. A free product can count. The CRA's recitals list signs of business activity, such as charging more than cost for support, or making money from the product in other ways. Free open-source software counts only when its maker makes money from it.
Legal term: “making available on the market”, “commercial activity”
Sources: CRA Art. 2(1), Art. 3(22); recitals 15, 16 and 18
Is it one of the products the CRA leaves out, such as a medical device?
- Yes Result: Likely outside the CRA: an exception applies
- No Result: Likely covered by the CRA
- Not sure Result: Not clear yet
See the full list
This is the complete list. Answer Yes only if your product fully matches one item:
- Products covered by the EU rules on medical devices (Regulation (EU) 2017/745) or on in vitro diagnostic medical devices (Regulation (EU) 2017/746).
- Products covered by the EU type-approval rules for motor vehicles and their trailers (Regulation (EU) 2019/2144).
- Products certified under the EU civil aviation rules (Regulation (EU) 2018/1139).
- Equipment covered by the EU rules on marine equipment (Directive 2014/90/EU).
- Spare parts that replace identical parts and are made to the same specifications as the parts they replace.
- Products built or changed only for national security or defence, or designed specifically to process classified information.
- Products covered by the EU rules on two- and three-wheel vehicles and quadricycles (Regulation (EU) No 168/2013), excluded by Delegated Regulation (EU) 2025/1535. L1e vehicles designed to be pedalled are not excluded.
In the Commission's non-binding reading, items 2 and 7 cover a part only if it is designed only for those vehicles. Being covered by another EU law does not, on its own, take a product out of the CRA.
Legal term: “This Regulation does not apply to …”
Sources: CRA Art. 2(2) to 2(7); Delegated Regulation (EU) 2025/1535, Art. 1; Commission guidance C(2026) 5252 final (non-binding)
Your result
Likely covered by the CRA
Reporting of actively exploited vulnerabilities and severe incidents (Article 14) has applied since 11 September 2026; the essential security requirements and CE marking apply from 11 December 2027.
Reasoning and source
From your answers, your product meets every condition and no exception applies. An online service it needs for one of its features, built by its maker or for them, is covered as part of it.
Legal term: “product with digital elements”, “remote data processing”
Sources: CRA Art. 2(1), Art. 3(1), Art. 3(2), Art. 71(2)
Likely covered along with the product it serves
Whether the CRA applies depends on the device or app that needs this service, so run the check for that product.
Reasoning and source
The CRA treats an online service that a product needs, built by its maker or for them, as part of that product. So this service follows the product it serves. Run the check again for that product: if the CRA likely applies to it, this service is covered with it. The rules for such a service do not reach the maker's whole network and IT systems.
Legal term: “remote data processing”
Sources: CRA Art. 3(1), Art. 3(2); recital 11
Likely outside the CRA: not a product it covers
From your answer, it is neither software nor a device or part that stores, processes or sends data.
Reasoning and source
The CRA covers software, and devices and parts that store, process or send data, together with the online services they need. Parts count even when supplied on their own. From your answer, yours is none of these, so it likely falls outside the CRA.
Legal term: “product with digital elements”, “hardware”
Sources: CRA Art. 2(1), Art. 3(1), Art. 3(5)
Likely outside the CRA: an online service not tied to a product
Check again if you start offering software that people download or install.
Reasoning and source
In the European Commission's non-binding reading, software that people only use over the internet, such as a web app opened in a browser, is not on that basis alone a product the CRA covers. From your answers, it is also not an online service that a device or app needs and that was built by or for that product's maker, so it likely falls outside the CRA. If you later offer software that runs on the user's device, such as an app or a browser extension, check again.
Legal term: “product with digital elements”, “remote data processing”
Sources: CRA Art. 3(1), Art. 3(2); recital 12; Commission guidance C(2026) 5252 final and Commission FAQ (non-binding)
Likely outside the CRA: no data connection
Check again if people could predictably connect it, even through another device.
Reasoning and source
The CRA only covers products meant to connect to a device or network to send or receive data, directly or indirectly, or likely to be used that way. From your answer, yours is not, so it likely falls outside the CRA. If a predictable use would connect it, even through something else, check again.
Legal term: “intended purpose”, “reasonably foreseeable use”, “direct or indirect logical or physical data connection”
Sources: CRA Art. 2(1), Art. 3(8) to 3(10), Art. 3(23), Art. 3(24)
Likely outside the CRA: not supplied in the EU as a business
Check again if you start supplying it in the EU or making money from it.
Reasoning and source
The CRA covers products supplied for sale or use in the EU as part of a business activity, whether paid or free. From your answer, yours is not. If you start supplying it in the EU, or start making money from it, check again.
Legal term: “making available on the market”, “commercial activity”
Sources: CRA Art. 2(1), Art. 3(22); recitals 15, 16 and 18
Likely outside the CRA: an exception applies
Each exception has conditions your product must fully meet.
Reasoning and source
From your answer, one of the exceptions in Article 2 of the CRA or in Delegated Regulation (EU) 2025/1535 applies, so your product likely falls outside the CRA. Each one has conditions: aviation products must be certified, spare parts must be identical and made to the same specifications, and national security or defence products must be built or changed only for that purpose.
Legal term: “This Regulation does not apply to …”
Sources: CRA Art. 2(2) to 2(7); Delegated Regulation (EU) 2025/1535, Art. 1
Not clear yet
Your "Not sure" answer decides the result, so the check stops here instead of guessing.
Reasoning and source
The explanation under that question and the FAQ answer linked below set out the rule to check against.
Open "Examples and legal text" under the question you were unsure about to see the rule and its source.
You were not sure about: Is it software, or a device or part that stores, processes or sends data?
Sources: CRA Art. 3(1), Art. 3(5)
You were not sure about: Is it a physical device, or software that people download or install on their own device, not just use in a web browser?
Sources: CRA Art. 3(1); Commission guidance C(2026) 5252 final (non-binding)
You were not sure about: Does a device or app need this online service for one of its features, and did that device or app's maker build the service, or have it built for them?
Sources: CRA Art. 3(1), Art. 3(2); recitals 11 and 12; Commission guidance C(2026) 5252 final (non-binding)
You were not sure about: Does it connect to another device or a network to send or receive data, even indirectly, in the way you intend or in a way people could predictably use it?
Sources: CRA Art. 2(1), Art. 3(8) to 3(10), Art. 3(23), Art. 3(24)
You were not sure about: Is it supplied for sale or use in the EU as part of a business activity, whether paid or free?
Sources: CRA Art. 2(1), Art. 3(22); recitals 15, 16 and 18
You were not sure about: Is it one of the products the CRA leaves out, such as a medical device?
Sources: CRA Art. 2(2) to 2(7); Delegated Regulation (EU) 2025/1535, Art. 1; Commission guidance C(2026) 5252 final (non-binding)
Compass, our free guided assessment for SMEs, also checks organisational maturity and reporting readiness. Try Compass free