Does the Cyber Resilience Act reach your product?

Who it applies to

A company deciding whether the Regulation reaches what it sells: installed and downloadable software is in, pure software as a service is out, and remote processing a product cannot work without comes in with the product.

The dates

Before any deadline matters, because every other duty follows from the answer.

The one thing to do

Answer the questions on this page for one product, and keep the result with its reason, because the determination is yours to make and to record.

The determination

Answer the first question and the reading starts; the page fills in as you go.

What this asks, and what it can answer

The tool asks 6 questions and reveals them one at a time. They are all here, with every answer it can reach, so you can follow the reasoning without answering anything.

1. What do you place on the EU market?
2. Does the product have a data connection, direct or indirect, logical or physical?
3. Is there processing on your side without which the product cannot perform one of its functions?
4. Does one of these already cover the product?
5. Is the product on Annex III or Annex IV?
6. Where is your main establishment?

The four answers

Outside the CRA

A service with no product behind it, or a product another EU instrument already covers: medical devices, motor vehicles, civil aviation and marine equipment are carved out, and free and open-source software outside a commercial activity is not placed on the market.

In scope, default

Most products with digital elements. The essential requirements apply and conformity is self-assessed: you build the technical file, run the assessment yourself and sign the declaration.

In scope, important

A product on Annex III. Class I may still be self-assessed if a harmonised standard covers it; class II needs a third party. Both sit in the categories listed below.

In scope, critical

A product on Annex IV. The Commission may require a European cybersecurity certificate, and conformity goes through a notified body.

The Annex III and Annex IV categories

In the Regulation's own wording, in English, because that is the text a notified body and a market surveillance authority read. The reference is the annex, the class and the point.

Annex III, class I (important)

• III.I.1Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers
• III.I.2Standalone and embedded browsers
• III.I.3Password managers
• III.I.4Software that searches for, removes, or quarantines malicious software
• III.I.5Products with digital elements with the function of virtual private network (VPN)
• III.I.6Network management systems
• III.I.7Security information and event management (SIEM) systems
• III.I.8Boot managers
• III.I.9Public key infrastructure and digital certificate issuance software
• III.I.10Physical and virtual network interfaces
• III.I.11Operating systems
• III.I.12Routers, modems intended for the connection to the internet, and switches
• III.I.13Microprocessors with security-related functionalities
• III.I.14Microcontrollers with security-related functionalities
• III.I.15Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
• III.I.16Smart home general purpose virtual assistants
• III.I.17Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems
• III.I.18Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking features
• III.I.19Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for children

Annex III, class II (important)

• III.II.1Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments
• III.II.2Firewalls, intrusion detection and prevention systems
• III.II.3Tamper-resistant microprocessors
• III.II.4Tamper-resistant microcontrollers

Annex IV (critical)

• IV.1Hardware Devices with Security Boxes
• IV.2Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council and other devices for advanced security purposes, including for secure cryptoprocessing
• IV.3Smartcards or similar devices, including secure elements

Work out the three deadlinesThe scope article, with the reasoning at lengthWhich parts of your backend are inside the CRA