Fossick › CRA scope check › Out of scope
Out of scope of the Cyber Resilience Act: what it means
On the answers given, the product is not a product with digital elements made available on the EU market, or it is covered by other Union legislation that displaces the CRA.
What the manufacturer must do
- Keep a short written record of why the CRA does not apply, with the product description and the date of the assessment.
- Re-run the check whenever the product gains a network connection, remote data processing, or a software update channel.
- Check whether sector legislation applies instead: MDR/IVDR for medical devices, UN R155/R156 and Regulation (EU) 2019/2144 for motor vehicles, or EASA rules for civil aviation.
Which deadlines apply
No CRA deadline applies. If the product changes and comes into scope, the reporting duties from 11 September 2026 and the full obligations from 11 December 2027 apply immediately, with no transition for that product.
What the conformity route looks like
No CRA conformity route and no CRA CE marking. Any CE marking on the product comes from the other legislation that covers it.
The reporting timeline
The reporting duty is the one that bites first, and it runs on three clocks that all start when the manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting the security of the product.
- 24 hours — early warning to ENISA and the CSIRT designated as coordinator in the Member State of main establishment.
- 72 hours — full notification, with an assessment of the vulnerability or incident and any corrective or mitigating measures taken.
- 14 days — final report once a corrective or mitigating measure is available: a description of the vulnerability, its severity and impact, and where available the exploitation vector.
The 14 day clock runs from the availability of the fix, not from the initial awareness, so a long remediation does not remove the earlier two deadlines.
Products already on the market are reached too
The reporting duty is not limited to new launches. From 11 September 2026 it applies to products with digital elements that are already placed on the EU market, for the whole time the manufacturer supports them. A product shipped in 2024 and still supported in 2027 is inside the regime, even though it was designed before it existed. The full set of obligations, including the technical documentation and CE marking, applies to products placed on the market from 11 December 2027, and to substantially modified versions of existing products after that date.
Check another product
This is guidance, not a legal determination. Classification under the Cyber Resilience Act depends on the full technical description of your product and, in borderline cases, on the assessment of a notified body or your national market surveillance authority.