Lehner & Szecsey
DE

CRA knowledge base

Scope

When does a connected product fall under the CRA – and what is excluded?

← Back to the FAQ overview

All questions in this topic

When is a product with digital elements in scope of the CRA?

When it is made available on the EU market and its intended or reasonably foreseeable use includes a direct or indirect connection to a device or network (Art. 2(1)) – unless one of the exemptions in Art. 2(2)–(4) applies.

Source: European Commission · FAQ 1.1 Official EU FAQ (original text)

What is a “product with digital elements”? Do stand-alone software or firmware count?

A software or hardware product and its remote data-processing solutions, including components placed on the market separately (Art. 3(1)). Stand-alone software and firmware are covered.

Source: European Commission · FAQ 1.2 Official EU FAQ (original text)

What is a direct or indirect logical or physical data connection to a device or network?

A physical connection uses physical means (wires, optical/mechanical interfaces, radio); a logical connection is a virtual data interface. “Indirect” means the connection happens via another device or network.

Source: European Commission · FAQ 1.3 Official EU FAQ (original text)

Does the CRA apply to products placed on the market before 11 December 2027?

In principle only if they are substantially modified from that date (Art. 69(2)). The reporting obligations under Art. 14 do, however, also apply to such existing products.

Source: European Commission · FAQ 1.4 Official EU FAQ (original text)

Are products manufactured only for one’s own use in scope of the CRA?

No. The CRA applies upon placing on the market. Manufacturing purely for one’s own use, without making it available on the market, is not “placing on the market”.

Source: European Commission · FAQ 1.5 Official EU FAQ (original text)

Can manufacturers release non-compliant software versions for testing?

Yes, unfinished software may be made available for a limited testing period – with a clearly visible sign indicating it is not yet compliant.

Source: European Commission · FAQ 1.6 Official EU FAQ (original text)

Can manufacturers maintain publicly accessible software archives?

Yes. Historical versions may be archived provided users are clearly and easily informed about the risks of using unsupported software (Art. 13(11)).

Source: European Commission · FAQ 1.7 Official EU FAQ (original text)

Are products for national security or defence purposes excluded?

Excluded are only products developed or modified exclusively for defence/national security, or specifically designed to process classified information (Art. 2(7)).

Source: European Commission · FAQ 1.8 Official EU FAQ (original text)

Are there products covered by other Union law and therefore exempt from the CRA?

Yes – e.g. medical devices (Reg. 2017/745, 2017/746) and certain automotive, aviation and certified products are exempt because they already meet equivalent cybersecurity requirements.

Source: European Commission · FAQ 1.9 Official EU FAQ (original text)

Topic blocks

Summarised and translated from the European Commission’s “FAQs on the Cyber Resilience Act” (v1.2, 16 January 2026), licensed under CC BY 4.0. Simplified by Lehner & Szecsey – the original text prevails. Official EU FAQ (original text).