96% more reported CVEs per day in 2026 than last year.
CRACI

CRA Checker

Find out in a few minutes whether your product is in scope of the Cyber Resilience Act, and what that means for you.

  1. 1
  2. 2
  3. 3
Does your product have digital elements?

Software, or hardware with software, that connects to a device or a network. Apps, operating systems, firmware and software components sold on their own count.

How is it made available in the EU?

The CRA covers products placed on the EU market in the course of a commercial activity, whether for payment or free of charge, including by manufacturers outside the EU.

Is it already covered by one of these EU rules or uses?

Medical devices and in vitro diagnostics, vehicle type-approval, certified aviation products, marine equipment, identical spare parts, or products built exclusively for national security or defense.

What are you checking?

Cloud services are covered only as the remote data processing a product needs to work. Software as a service on its own falls under NIS2 instead.

When is it placed on the EU market?

Products placed on the market before December 11, 2027 fall under the CRA only if they are substantially modified after that date, but the reporting obligations apply to them already.

What is your role for this product?

The manufacturer carries most of the obligations: whoever develops or manufactures the product, or has it made, and markets it under their own name or trademark.

What the CRA checker covers

Scope

Whether your product has digital elements, is on the EU market, and falls outside the exclusions for medical devices, vehicles, aviation, marine equipment and defense.

Role and timing

Whether you are the manufacturer, importer, distributor or an open-source steward, and whether only the reporting obligations apply to a product already on the market.

Category

Whether your product is default, important or critical under Annexes III and IV, and which conformity assessment route that allows.

New to the regulation? Read what the Cyber Resilience Act is first.

Cyber Resilience Act scope FAQ

Who the CRA applies to, and what the checker does and does not tell you

Who is in scope of the Cyber Resilience Act?

Products with digital elements, meaning hardware and software that connect to a device or network, made available on the EU market in the course of a commercial activity. That includes manufacturers outside the EU that sell into it, and software components sold on their own.

What is out of scope of the CRA?

Products already regulated by the EU medical device, in vitro diagnostic and vehicle type-approval rules, certified aviation products, marine equipment, identical spare parts, products built exclusively for national security or defense, and non-commercial open source (Article 2).

Does the CRA apply to SaaS?

Software as a service on its own falls under NIS2 rather than the CRA. Cloud services are covered only as the remote data processing a product needs to work, for example the backend that lets users control a smart home device.

Does the CRA apply to products already on the market?

The reporting obligations do, since September 11, 2026. Otherwise, products placed on the market before December 11, 2027 fall under the CRA only if they are substantially modified after that date.

Is this a CRA conformity assessment?

No. The checker is general guidance on whether and how the regulation applies. Under the CRA the manufacturer runs the conformity assessment, by self-assessment or, for some important and critical products, with a notified body.

Do you store my answers?

No. The checker runs in your browser and your answers are not sent anywhere. Use Print or save as PDF on the result to keep a copy.

In scope? Get the evidence from your builds

See how CRACI records an SBOM from every build, monitors what you shipped and submits CRA notifications on your behalf

Book a demo