Free · 2 minutes · no sign-up

Is my product in scope of the Cyber Resilience Act?

Answer eight questions. You get an indicative, automated assessment with the article references. It gives your product class, the conformity route and the obligations that apply by date to products like yours. The result pre-fills the first document of your kit.

The product

What do you make?

Do you also ship a client, app or device whose functions depend on your back end? Remote data processing designed by the manufacturer is in scope with the product (Article 3(2)).

Does the product have a data connection (network, Bluetooth, USB, API…), directly or through another device?

How is it supplied?

Is it made available to users in the EU?

Sector-specific rules?

Does it match a category of Annex III or IV?

Your role

Based on Regulation (EU) 2024/2847, Articles 2–3, 13–14, 18–21, 24, 69, Annexes III–IV and Implementing Regulation (EU) 2025/2392. This is an automated assessment of your answers, not legal advice. Borderline cases (embedded libraries, remote processing, monetised open source) deserve a second opinion.