Does the Cyber Resilience Act apply to your product? Scope, classes and deadlines
Updated 2 November 2026 · General information, not legal advice. Quotes are from the official text of the Cyber Resilience Act.
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity rules for almost every product with software in it that is sold in the EU. It applies to manufacturers wherever they are based, and also places obligations on importers and distributors. This guide covers whether your product is in scope, which class it falls into, and the dates that matter.
Is your product in scope?
This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.
A product with digital elements is "a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately" (Article 3(1)). In practice that covers connected devices, desktop and mobile apps, firmware, and software components sold on their own.
Cloud services count only as the remote data processing of a product: processing at a distance that the manufacturer designed, and without which the product can't perform one of its functions (Article 3(2)). The backend that a smart thermostat needs is in scope together with the thermostat. A standalone SaaS product generally falls under the NIS2 Directive instead (recital 12).
What is excluded
- medical devices and in vitro diagnostic devices (Regulations (EU) 2017/745 and 2017/746);
- motor vehicles and their systems covered by type-approval Regulation (EU) 2019/2144;
- products certified under the civil aviation Regulation (EU) 2018/1139;
- marine equipment under Directive 2014/90/EU;
- spare parts that replace identical components and are made to the same specifications;
- products developed or modified exclusively for national security or defence, or designed to process classified information.
These come from Article 2(2) to (7). Article 2(5) also allows other sectoral rules to limit the CRA where they give the same or better protection.
Which class is your product in?
The class decides how you show conformity. Most products are in the default class and can be self-assessed. Products whose core function matches a category in Annex III (important) or Annex IV (critical) need more (Article 32).
Default (most products)
Examples: Most apps, connected devices and components that aren't listed in Annex III or IV.
How to show conformity: Self-assessment by the manufacturer (internal control, module A).
Important, class I (Annex III)
Examples: Browsers, password managers, VPNs, operating systems, routers and modems, boot managers, smart home products with security functions such as door locks, cameras and alarm systems, connected toys, wearables for health or for children.
How to show conformity: Self-assessment only if you fully apply harmonised standards, common specifications or a European cybersecurity certification scheme (assurance level at least 'substantial'). Otherwise a notified body is involved (module B with C, or module H).
Important, class II (Annex III)
Examples: Hypervisors and container runtimes, firewalls and intrusion detection or prevention systems, tamper-resistant microprocessors and microcontrollers.
How to show conformity: A notified body is involved (module B with C, or module H), or a European cybersecurity certification scheme.
Critical (Annex IV)
Examples: Hardware devices with security boxes, smart meter gateways, smartcards and secure elements.
How to show conformity: A European cybersecurity certificate where one is required under Article 8(1); otherwise the class II routes.
The examples above are a selection; check the full lists in Annexes III and IV.
The key dates
| 10 December 2024 | The Cyber Resilience Act enters into force, 20 days after publication in the Official Journal. |
| 11 June 2026 | Rules for conformity assessment bodies (notified bodies) apply (Chapter IV). |
| 11 September 2026 | Article 14 reporting applies: actively exploited vulnerabilities and severe incidents must be reported, including for products already on the market. |
| 11 December 2027 | Everything else applies. Products placed on the market from this date must meet the essential requirements and carry the CE marking for the CRA. |
Products placed on the market before 11 December 2027 only have to meet the full requirements if they are substantially modified after that date (Article 69(2)). Reporting is different: Article 14 already applies to them since 11 September 2026 (Article 69(3)). Read the Article 14 guide.
What the CRA asks of manufacturers from December 2027
- meet the essential cybersecurity requirements in Annex I, Part I, for the product itself;
- handle vulnerabilities for the whole support period (Annex I, Part II), including keeping an SBOM;
- set a support period of at least five years, unless the product is expected to be in use for less (Article 13(8));
- exercise due diligence when integrating third-party components, including open-source ones (Article 13(5));
- draw up technical documentation (Annex VII) and an EU declaration of conformity, and affix the CE marking.
Non-compliance with the essential requirements or with Articles 13 and 14 can be fined up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher (Article 64(2)).
What to do now
- List the products you sell in the EU and check each against the scope and exclusions above.
- Classify each one: default, important class I or II, or critical.
- Set up Article 14 reporting now, because it already applies to everything on the market.
- Start keeping an SBOM for every release (CRA SBOM requirements).
- Plan your conformity route and documentation for products you will place on the market from December 2027.
ShipAttest walks you through scope and classification for each product, then drafts the technical documentation and the EU declaration of conformity from your product record. See how it works.