Question 1

Which products does the Cyber Resilience Act apply to?

Accepted Answer

Regulation (EU) 2024/2847 applies to all products with digital elements made available on the EU market whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Art. 2(1)). This includes software, connected hardware, IoT devices, components and their remote data processing solutions.

Question 2

Which products are excluded from the CRA?

Accepted Answer

Excluded: medical devices (Reg. 2017/745 and 2017/746), motor vehicles (Reg. 2019/2144), civil aviation (Reg. 2018/1139), marine equipment (Dir. 2014/90/EU), defence or national security products and non-commercial free open-source software without commercial activity (Art. 2, Recitals 17-18).

Question 3

When do I need to comply with the CRA?

Accepted Answer

The vulnerability and incident reporting obligations (Art. 14) apply from 11 September 2026. Full application of the Regulation, including Annex VII technical documentation and the essential cybersecurity requirements, applies from 11 December 2027.

Does your product need CRA technical documentation?