Scope, product categories, and conformity

Regulation (EU) 2024/2847 is the Cyber Resilience Act (CRA). Its rules are for scope, product categories, conformity assessment, technical documentation, the EU declaration of conformity, and CE marking. Manufacturers have conformity assessment obligations, and importers and distributors have related obligations in Articles 19(2) and 20(2). In the conditions of Articles 21 and 22, an importer, a distributor, or a different person is also “considered to be a manufacturer”. See Persons considered to be a manufacturer.

The CRA applies from 11 December 2027 (Article 71(2)). Chapter IV of the CRA (Articles 35 to 51), on the “notification of conformity assessment bodies”, applies from 11 June 2026. For a product placed on the market before 11 December 2027, see Placing on the market and substantial modification. For all dates, see the dates of the CRA.

Scope — Article 2

Article 2(1) of the CRA gives this scope test for the Regulation:

This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.

In Article 3(1), a product with digital elements “means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately”. Thus a component can be a product with digital elements. Points (8) to (10) of Article 3 are about a logical connection, a physical connection, and an indirect connection.

The scope test of the CRA does not refer to AI. A product that uses AI is in scope when Article 2(1) applies to it. Article 12 adds rules only for a product in scope that is also a high-risk AI system. See Article 12.

Article 2 removes these products from the scope of the CRA:

• products with digital elements to which Regulation (EU) 2017/745, Regulation (EU) 2017/746, or Regulation (EU) 2019/2144 applies (Article 2(2))
• products with digital elements “that have been certified in accordance with Regulation (EU) 2018/1139” (Article 2(3))
• equipment “that falls within the scope of Directive 2014/90/EU” (Article 2(4))
• spare parts “that are made available on the market to replace identical components in products with digital elements and that are manufactured according to the same specifications as the components that they are intended to replace” (Article 2(6))
• products with digital elements “developed or modified exclusively for national security or defence purposes”, and products “specifically designed to process classified information” (Article 2(7)).

Article 2(5) gives a different rule for products “covered by other Union rules”, with these conditions:

The application of this Regulation to products with digital elements covered by other Union rules laying down requirements that address all or some of the risks covered by the essential cybersecurity requirements set out in Annex I may be limited or excluded where: (a) such limitation or exclusion is consistent with the overall regulatory framework that applies to those products; and (b) the sectoral rules achieve the same or a higher level of protection as that provided for by this Regulation.

For this rule, the Commission “is empowered to adopt delegated acts” (Article 2(5)).

In the Commission services FAQ v1.4, Delegated Regulation (EU) 2025/1535 removes products with digital elements in the scope of Regulation (EU) No 168/2013 from CRA scope. It does not remove “L1e category vehicles designed to pedal”. The Commission guidance also gives the rule for Regulation (EU) No 168/2013 (paragraph 242). The FAQ and guidance are not binding. See Guidance.

Free and open-source software (Article 3(48)) is in scope only when it is made available on the market. Making available on the market is a supply “in the course of a commercial activity, whether in return for payment or free of charge” (Article 3(22)).

An open-source software steward has its obligations in Article 24. See Open-source software stewards. A manufacturer must “exercise due diligence when integrating components sourced from third parties” (Article 13(5)). This also applies to free and open-source components that are not made available in a commercial activity. See Components.

Remote data processing — Article 3(2)

In the CRA, the remote data processing solutions of a manufacturer’s product are part of that product (Article 3(1)). Data processing is remote data processing in Article 3(2) only if:

• the data processing is “at a distance”,
• the software for the data processing “is designed and developed by the manufacturer, or under the responsibility of the manufacturer”, and
• without the data processing, the product cannot do one of its functions. In the CRA, this condition is “the absence of which would prevent the product with digital elements from performing one of its functions”.

The Commission guidance for the CRA gives more information about remote data processing. The Commission gave its approval to the “content of the draft Communication” in C(2026) 5252. This guidance is not binding. See Guidance. The guidance uses “RDPS” for remote data processing solutions. The guidance gives these points:

• “In understanding RDPS, the notion of ‘who operates the solution’ is not a decisive factor, as the CRA definition only refers to the design and development of the RDPS” (paragraph 196).
• If a product can do all its functions without a data processing, that data processing is not remote data processing. An example is “remote analysis of telemetry data collected purely for statistical purposes or future product development” (paragraph 192).
• A product can use a third-party solution for one of its functions. If the software of that solution is “not designed and developed by the manufacturer, or under its responsibility”, the solution is not remote data processing (paragraphs 200 and 202(c)). For such a solution, the guidance tells manufacturers to “treat the third-party solution as a component”. It also tells them to “assess the risks stemming from the integration of such solution and mitigate them accordingly”, and to “exercise due diligence” (paragraphs 201 and 202(c)).
• “Further back-end systems that carry out subsequent processing, and with which the product with digital elements does not directly interact, are not considered RDPS” (paragraph 205). These back-end systems “remain external dependencies that must be assessed as part of the cybersecurity risk assessment and mitigated through product-level measures” (paragraph 206).

Placing on the market and substantial modification

For a manufacturer, Article 3 of the CRA gives these definitions for product supply:

• Placing on the market — “the first making available of a product with digital elements on the Union market” (Article 3(21)).
• Making available on the market — “the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge” (Article 3(22)).

Thus the first supply on the Union market is the placing on the market, and it is also a making available on the market.

A substantial modification is “a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I or which results in a modification to the intended purpose for which the product with digital elements has been assessed” (Article 3(30)).

A substantial modification has two effects in the CRA:

• Substantial modification is the condition in Article 69(2) for products placed on the market before 11 December 2027. Article 69(3) makes Article 14 apply to all of these products (transitional provisions).
• An importer, a distributor, or a different person that “carries out a substantial modification” can be “considered to be a manufacturer” (Articles 21 and 22). See Persons considered to be a manufacturer.

Product categories and conformity assessment — Articles 7, 8, and 32

In the CRA, the core functionality of a product sets its category. The category sets the conformity assessment procedures that the manufacturer can use.

• Important products — products “which have the core functionality of a product category set out in Annex III” (Article 7(1)). Annex III divides these categories into class I and class II. Article 7(1) adds this rule: “The integration of a product with digital elements which has the core functionality of a product category set out in Annex III shall not in itself render the product in which it is integrated subject to the conformity assessment procedures referred to in Article 32(2) and (3).”
• Critical products — products “that have the core functionality of a product category that is set out in Annex IV” (Article 8(1)).
• Other products in scope — products not in Annexes III and IV.

The category has an effect only on the conformity assessment procedure. The requirements of Annex I and the obligations of Articles 13 and 14 apply to each product in scope, in all categories (Articles 6, 13, and 14).

Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 gives “the technical description of the categories of important and critical products with digital elements”. This is the implementing act of Article 7(4) of the CRA. Its Annex I gives the “technical description of the categories of products with digital elements under classes I and II listed in Annex III” (its Article 2). Its Annex II gives the “technical description of the categories of products with digital elements listed in Annex IV” (its Article 2). The Official Journal date of this Implementing Regulation is 1 December 2025 (OJ L, 2025/2392). It “shall enter into force on the twentieth day following that of its publication” (its Article 3).

Annex VIII of the CRA gives the procedures. Module A is internal control. Module B is EU-type examination. Module C is “conformity to EU-type based on internal production control”. Module H is full quality assurance. The conformity assessment procedures of Article 32 for each category are:

Category	Annex	Conformity assessment procedure
Other products in scope	Not in Annex III or Annex IV	The Article 32(1) procedures: module A, module B and then module C, module H, or, “where available and applicable”, a certification scheme of Article 27(9)
Important product, class I	Annex III, class I	Article 32(2): module B and then module C, or module H, “with regard to those essential cybersecurity requirements”. This applies when the manufacturer “has not applied or has applied only in part harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least ‘substantial’ as referred to in Article 27, or where such harmonised standards, common specifications or European cybersecurity certification schemes do not exist”. In all other conditions, the Article 32(1) procedures apply.
Important product, class II	Annex III, class II	Article 32(3): module B and then module C, module H, or, “where available and applicable”, a European cybersecurity certification scheme of Article 27(9) “at assurance level at least ‘substantial’ pursuant to Regulation (EU) 2019/881”
Critical product	Annex IV	Article 32(4): a European cybersecurity certification scheme “in accordance with Article 8(1)”, or, “where the conditions in Article 8(1) are not met”, one of the Article 32(3) procedures

For class I, the Commission FAQ v1.4 tells manufacturers that module A is available “if a harmonised standard has been applied in accordance with Article 32(2)”.

Article 32(5) gives a special rule for free and open-source software. It applies to manufacturers of products “qualifying as free and open-source software, which fall under the categories set out in Annex III”. These manufacturers can use one of the Article 32(1) procedures. The condition is that “the technical documentation referred to in Article 31 is made available to the public at the time of the placing on the market of those products” (Article 32(5)).

Article 12 — High-risk AI systems

Article 12 of the CRA applies only to products in scope that are “classified as high-risk AI systems pursuant to Article 6” of the EU AI Act (Regulation (EU) 2024/1689). Article 12 does not set the CRA category. Articles 7 and 8 set the category.

In Article 12(1), such a product “shall be deemed to comply with the cybersecurity requirements set out in Article 15” of the AI Act when:

• “those products fulfil the essential cybersecurity requirements set out in Part I of Annex I”,
• “the processes put in place by the manufacturer comply with the essential cybersecurity requirements set out in Part II of Annex I”, and
• “the achievement of the level of cybersecurity protection required under Article 15 of Regulation (EU) 2024/1689 is demonstrated in the EU declaration of conformity issued under this Regulation”.

This rule applies “Without prejudice to the requirements relating to accuracy and robustness set out in Article 15” of the AI Act. Article 42(3) of the AI Act gives the same rule from the side of the AI Act. Regulation (EU) 2026/1744 put this paragraph into Article 42 of the AI Act.

In Article 12(2), “the relevant conformity assessment procedure provided for in Article 43 of Regulation (EU) 2024/1689 shall apply” to these products. The notified bodies for high-risk AI systems in the AI Act “shall also be competent to control the conformity” of these products with Annex I of the CRA. The condition is that the AI Act notification procedure examined their compliance with Article 39 of the CRA (Article 12(2)).

Article 12(3) is a derogation from Article 12(2). It applies to a high-risk AI system in Article 6 of the AI Act, if the AI Act procedure “based on internal control as referred to in Annex VI” applies to it. The product must also be in one of these groups:

• important products of Annex III “which are subject to the conformity assessment procedures referred to in Article 32(2), points (a) and (b), and Article 32(3) of this Regulation”
• critical products of Annex IV “which are required to obtain a European cybersecurity certificate pursuant to Article 8(1) of this Regulation or, absent that, which are subject to the conformity assessment procedures referred to in Article 32(3) of this Regulation”.

These products are subject to the CRA conformity assessment procedures “in so far as the essential cybersecurity requirements set out in this Regulation are concerned” (Article 12(3)).

Article 12(3) applies only to some categories. Thus make the decisions in this sequence:

1. Find if the product is a high-risk AI system in Article 6 of the AI Act.
2. If it is not, use the applicable Article 32 procedure. Do not continue with steps 3 to 6.
3. For a high-risk AI system, find the CRA category and its Article 32 procedures.
4. Check each condition of Article 12(3) to find if the product is subject to that paragraph.
5. If the product is subject to Article 12(3), use the CRA procedures for the essential cybersecurity requirements.
6. If it is not, use the AI Act Article 43 procedure for those cybersecurity requirements (Article 12(2)).

Other Union legal acts can also apply to a product of Article 12. For such a product, the cybersecurity risk assessment can be part of the risk assessment of those Union legal acts (Article 13(4)). See The cybersecurity risk assessment. If those other Union legal acts “provide for technical documentation”, the manufacturer prepares one set of technical documentation (Article 31(3)). The set contains “the information referred to in Annex VII and the information required by those Union legal acts”. See Technical documentation.

Harmonized standards and presumption of conformity — Article 27

Article 27 of the CRA gives manufacturers three sources of a presumption of conformity with the essential cybersecurity requirements of Annex I. Each source gives a presumption of conformity only for the requirements that it includes:

• Harmonized standards — Article 27(1), first subparagraph:

  Products with digital elements and processes put in place by the manufacturer which are in conformity with harmonised standards or parts thereof, the references of which have been published in the Official Journal of the European Union, shall be presumed to be in conformity with the essential cybersecurity requirements set out in Annex I covered by those standards or parts thereof.

• Common specifications — “the common specifications established by implementing acts referred to in paragraph 2” of Article 27 (Article 27(5)). The Commission can make these implementing acts only in the conditions of Article 27(2).

• Certification schemes — an EU statement of conformity or a European cybersecurity certificate “issued under a European cybersecurity certification scheme adopted pursuant to Regulation (EU) 2019/881” (Article 27(8)).

The essential cybersecurity requirements of Annex I apply to each product in scope also when no harmonized standard is available (Articles 6 and 13(1)). The Commission FAQ v1.4 tells manufacturers that “the use of harmonised standards is voluntary”. It also tells them that they can show conformity by “other technical means” and that they “are required to document them in their technical documentation”.

The Commission gives this information in “Cyber Resilience Act - Standardisation” (changed last on 31 July 2026): “The European Commission has adopted a standardisation request M/606, containing a set of 41 standards in support of the CRA”. There, the Commission names no harmonized standard “the references of which have been published in the Official Journal”. The FAQ v1.4 (4 September 2026) gives these dates. Each standard is “to be adopted by the ESOs”, the European standardization organizations, by its date:

• 15 horizontal standards, “clustered in 3 deliverables”, with these dates:
  • the standard “on designing, developing and producing products with digital elements in such a way that they ensure an appropriate level of cybersecurity based on the risks”, by 30 August 2026
  • the standard “covering the essential cybersecurity requirements relating to the properties of products with digital elements as set out in Part I of Annex I”, by 30 October 2027
  • the standard “on vulnerability handling for products with digital elements”, by 30 August 2026.
• 26 vertical standards for the categories of Annexes III and IV, by 30 October 2026.

These dates are for standards “to be adopted by the ESOs”. The FAQ does not tell manufacturers if the ESOs “adopted” the standards by those dates.

When a European standardization organization gives a harmonized standard to the Commission for the Official Journal, the Commission “shall assess the harmonised standard” (Article 27(6)).

Technical documentation — Article 31 and Annex VII

In the CRA, the manufacturer must prepare the technical documentation before the placing on the market of the product (Articles 13(12) and 31(2)). The technical documentation “shall contain all relevant data or details of the means used by the manufacturer to ensure that the product with digital elements and the processes put in place by the manufacturer comply with the essential cybersecurity requirements set out in Annex I” (Article 31(1)). It contains a minimum of the information in Annex VII. It “shall be continuously updated, where appropriate, at least during the support period” (Article 31(2)).

The manufacturer must keep the technical documentation and the EU declaration of conformity “at the disposal of the market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer” (Article 13(13)).

Annex VII gives the minimum contents of the technical documentation, “as applicable to the relevant product with digital elements”:

Point of Annex VII	Contents of the technical documentation
1	“a general description of the product with digital elements”. This includes the intended purpose, the versions of software “affecting compliance with essential cybersecurity requirements”, and the information and instructions of Annex II. For a hardware product, it includes “photographs or illustrations showing external features, marking and internal layout”.
2	“a description of the design, development and production of the product with digital elements and vulnerability handling processes”, with this information. 2(a): “necessary information on the design and development of the product with digital elements, including, where applicable, drawings and schemes and a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing”. 2(b): “necessary information and specifications of the vulnerability handling processes put in place by the manufacturer, including the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solutions chosen for the secure distribution of updates”. 2(c): “necessary information and specifications of the production and monitoring processes of the product with digital elements and the validation of those processes”.
3	The cybersecurity risk assessment of Article 13, with how the requirements of Annex I, Part I, apply. In Article 13(4), the technical documentation also contains a “clear justification” for each essential cybersecurity requirement that does not apply. See The cybersecurity risk assessment.
4	The information that the manufacturer used to set the support period (Article 13(8)).
5	The standards, common specifications, and certification schemes that the manufacturer applied, or the solutions of the manufacturer (see the next paragraph).
6	“reports of the tests carried out to verify the conformity” of the product and of the vulnerability handling processes with Annex I, Parts I and II.
7	“a copy of the EU declaration of conformity”.
8	“where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in Annex I”. See Software bill of materials.

Point 5 of Annex VII has two parts:

• the harmonized standards “the references of which have been published in the Official Journal”, the common specifications of Article 27, and the European cybersecurity certification schemes of Article 27(8) that the manufacturer “applied in full or in part”
• if the manufacturer did not apply them, “descriptions of the solutions adopted to meet the essential cybersecurity requirements set out in Parts I and II of Annex I, including a list of other relevant technical specifications applied”.

If the manufacturer applied them only in part, the technical documentation “shall specify the parts which have been applied”.

Microenterprises and small enterprises “may provide all elements of the technical documentation specified in Annex VII by using a simplified format” (Article 33(5)). For microenterprises and small enterprises, the Commission “shall, by means of implementing acts, specify the simplified technical documentation form”. A microenterprise or a small enterprise that “opts to provide the information set out in Annex VII in a simplified manner” must use that simplified technical documentation form. Notified bodies must accept that simplified technical documentation form for conformity assessment.

EU declaration of conformity and CE marking — Articles 28 to 30

In the CRA, the manufacturer must “carry out the chosen conformity assessment procedures as referred to in Article 32 or have them carried out” (Article 13(12)). Then Article 13(12) gives a condition and two tasks. The condition is that the procedure shows these two results:

• The product complies with Annex I, Part I.
• The vulnerability handling processes of the manufacturer comply with Annex I, Part II.

When the conformity assessment shows the two results above, the manufacturer must do these two tasks:

• Prepare the EU declaration of conformity (Article 28).
• Affix the CE marking (Article 30).

Article 30(5) also gives this rule:

Where the product with digital elements is subject to Union harmonisation legislation, other than this Regulation, which also provides for the affixing of the CE marking, the CE marking shall indicate that the product also fulfils the requirements set out in such other Union harmonisation legislation.

Article 28 gives these rules for the EU declaration of conformity:

• The EU declaration of conformity must “state that the fulfilment of the applicable essential cybersecurity requirements set out in Annex I has been demonstrated” (Article 28(1)).
• The EU declaration of conformity has the “model structure set out in Annex V”. It contains “the elements specified in the relevant conformity assessment procedures set out in Annex VIII”. It “shall be updated as appropriate”. It is available “in the languages required by the Member State in which the product with digital elements is placed on the market or made available on the market” (Article 28(2)).
• When “more than one Union legal act requiring an EU declaration of conformity” applies to the product, the manufacturer prepares one EU declaration of conformity for all of these Union legal acts. That EU declaration of conformity identifies these Union legal acts, “including their publication references” (Article 28(3)).
• “By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the compliance of the product with digital elements” (Article 28(4)).

The manufacturer must give with the product a copy of the EU declaration of conformity or a simplified EU declaration of conformity (Article 13(20)). The simplified EU declaration of conformity has the “model structure set out in Annex VI” (Article 28(2)). It must be available “in the languages required by the Member State in which the product with digital elements is placed on the market or made available on the market”. It “shall contain the exact internet address at which the full EU declaration of conformity can be accessed” (Article 13(20)).

The CE marking follows “the general principles set out in Article 30 of Regulation (EC) No 765/2008” (Article 29). Article 30 gives these rules for the CE marking:

• The CE marking “shall be affixed visibly, legibly and indelibly to the product with digital elements”. If that is “not possible or not warranted on account of the nature of the product”, the CE marking is on the “packaging” and on the EU declaration of conformity (Article 30(1)).
• For software, the CE marking is on the EU declaration of conformity or “on the website accompanying the software product”. That section of the website “shall be easily and directly accessible to consumers” (Article 30(1)).
• The CE marking “shall be affixed before the product with digital elements is placed on the market” (Article 30(3)).
• When a notified body is part of the module H procedure, the identification number of that notified body follows the CE marking (Article 30(4)).

Series of production and corrective measures — Article 13(14) and (21)

In Article 13(14) of the CRA, the manufacturer must “ensure that procedures are in place” for products “that are part of a series of production to remain in conformity with this Regulation”. The manufacturer “shall adequately take into account” changes in:

• “the development and production process”
• “the design or characteristics of the product with digital elements”
• the harmonized standards, European cybersecurity certification schemes, or common specifications of Article 27 “by reference to which the conformity of the product with digital elements is declared or by application of which its conformity is verified”.

Article 13(21) applies “From the placing on the market and for the support period”. It applies to manufacturers “who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential cybersecurity requirements set out in Annex I”. These manufacturers “shall immediately take the corrective measures necessary” for one of these results, “as appropriate”:

• “to bring that product with digital elements or the manufacturer’s processes into conformity”
• “to withdraw or recall the product”.

For the information that market surveillance authorities can get from a manufacturer, and for the records that economic operators keep, see authorities and records.

Scope and conformity in Modulos

In Modulos, the CRA has two Frameworks: OFF-26 at the Organization level and MFF-26 at the AI System level. For MRF-450, MRF-451, and MRF-473 to MRF-475, see Requirements of the CRA Frameworks.

Where to go next

Cyber Resilience Act overview

The dates of the CRA, the guidance, the market surveillance authorities, and the penalties

Risk assessment and Annex I

The cybersecurity risk assessment, the requirements of Annex I, Part I, and components

Vulnerability handling and the support period

The requirements of Annex I, Part II, the support period, the software bill of materials, and information to users

Reporting and economic operators

Article 14 notifications, importers, distributors, authorized representatives, and stewards

Operationalizing the CRA in Modulos

The two CRA Frameworks, the decisions before you add them, the steps, and the Requirements

Sources

• Regulation (EU) 2024/2847 (Cyber Resilience Act, CRA), OJ L, 2024/2847, 20.11.2024. EUR-Lex. Provisions: Articles 2, 3(1), 3(2), 3(8) to (10), 3(21), 3(22), 3(30), and 3(48). Also Articles 6, 7(1), 7(4), 8(1), 12, 13(1), 13(4), 13(5), 13(12) to (14), 13(20), and 13(21). Also Articles 21, 22, 27 to 32, 33(5), 69(2), 69(3), and 71(2), and Annexes III to VIII.
• Implementing Regulation (EU) 2025/2392 of the Commission of 28 November 2025, OJ L, 2025/2392, 1.12.2025: Articles 2 and 3. EUR-Lex.
• EU AI Act — Regulation (EU) 2024/1689, version of 27 July 2026: Articles 6, 15, 42(3), and 43, and Annex VI. Regulation (EU) 2026/1744 added Article 42(3). EUR-Lex, 27 July 2026, Regulation (EU) 2026/1744.
• Commission guidance for the CRA — C(2026) 5252 of 27 July 2026 and its Annex (not binding). Paragraphs 192, 196, 200, 201, 202, 205, 206, and 242. European Commission.
• “Cyber Resilience Act - Frequently Asked Questions”, version 1.4 of 4 September 2026, Commission services: FAQ on products subject to other Union acts, and FAQ 4.2.1, 6.1, and 6.10. European Commission.
• “Cyber Resilience Act - Standardisation”, European Commission, changed last on 31 July 2026. European Commission.

Disclaimer

This page gives general information. It is not legal advice.