CRA scoping checklist

What it is for

This checklist helps manufacturers, importers and distributors record, product by product, the facts that matter when examining whether the Cyber Resilience Act (Regulation (EU) 2024/2847) may apply and in which role. Each question points to the provisions it is based on.

It deliberately produces no verdict. Its purpose is a dated, documented analysis that you, or an adviser, can review.

How to use it

1. Use one copy per product or product version.
2. For each item, read the cited provisions in the official text before answering.
3. Record the answer, the evidence and the person who checked it.
4. Mark an item as "Unclear" rather than guessing, and list these items for expert review.
5. Date the checklist and review it when the product, its intended purpose, its market or its distribution model changes.

1. The product

• 1.1 Is the product a software or hardware product, including software or hardware components placed on the market separately? — Article 3, point (1), Article 3, point (4), Article 3, point (5), Article 3, point (6)
• 1.2 Does the product rely on data processing at a distance whose software is designed and developed by you, or under your responsibility, and without which one of its functions could not be performed? — Article 3, point (2), Recital 11, Recital 12
• 1.3 Does the intended purpose or reasonably foreseeable use of the product include a direct or indirect logical or physical data connection to a device or network? — Article 2(1), Article 3, point (8), Article 3, point (9), Article 3, point (10)

2. Market and timing

• 2.1 Is the product supplied for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge? — Article 3, point (22), Article 3, point (21)
• 2.2 When was, or will be, each version first placed on the Union market — before or after 11 December 2027? — Article 71(2), Article 69(2), Article 69(3)
• 2.3 Have changes made after placing on the market affected compliance with Part I of Annex I, or modified the intended purpose for which the product was assessed? — Article 3, point (30)

3. Free and open-source software

• 3.1 Is the product, or the part you supply, free and open-source software? — Article 3, point (48)
• 3.2 If so, is it monetised or otherwise supplied in the course of a commercial activity? — Recital 17, Recital 18
• 3.3 Is your organisation an open-source software steward? — Article 3, point (14), Article 24
• 3.4 Does the product integrate third-party components, including free and open-source components? — Article 13(5), Article 13(6)

4. Exclusions and other Union legislation

• 4.1 Does Regulation (EU) 2017/745 (medical devices), Regulation (EU) 2017/746 (in vitro diagnostic medical devices) or Regulation (EU) 2019/2144 (type-approval of motor vehicles) apply to the product? — Article 2(2)
• 4.2 Has the product been certified in accordance with Regulation (EU) 2018/1139 (civil aviation)? — Article 2(3)
• 4.3 Is it equipment within the scope of Directive 2014/90/EU (marine equipment)? — Article 2(4)
• 4.4 Was it developed or modified exclusively for national security or defence purposes, or is it specifically designed to process classified information? — Article 2(7)
• 4.5 Is it a spare part replacing an identical component, manufactured to the same specifications? — Article 2(6)
• 4.6 Do other Union rules address all or some of the same risks, and has a delegated act limited or excluded the application of the Regulation? — Article 2(5), first subparagraph, Article 2(5), second subparagraph
• 4.7 Is the product classified as a high-risk AI system under Regulation (EU) 2024/1689? — Article 12(1)

5. Product category

• 5.1 Does the product have the core functionality of a category listed in Annex III (important products, class I or II)? — Article 7(1), Annex III, Article 7(4)
• 5.2 Does it have the core functionality of a category listed in Annex IV (critical products)? — Article 8(1), first subparagraph, Annex IV, Article 32(4)

6. Your role

• 6.1 Manufacturer: you develop or manufacture the product, or have it designed, developed or manufactured, and market it under your name or trademark. — Article 3, point (13), Article 13, Article 14
• 6.2 Importer: you are established in the Union and place on the market a product bearing the name or trademark of a person established outside the Union. — Article 3, point (16), Article 19
• 6.3 Distributor: you make the product available on the Union market without affecting its properties, other than as manufacturer or importer. — Article 3, point (17), Article 20
• 6.4 Do you, as importer or distributor, place the product on the market under your own name or trademark, or carry out a substantial modification? Does another person substantially modify it and make it available? — Article 21, Article 22(1)
• 6.5 Has the manufacturer appointed an authorised representative? — Article 18

7. Record and review

Downloadable version

The Excel workbook and the Word document contain the same 25 items, with a guidance note for each item and empty Status, Owner and Notes columns to fill in.