Your result
Manufacturer, standard product
As the manufacturer, you can assess conformity internally
Your product is not on the EU’s lists of important or critical products, so you can use internal conformity assessment. The other duties still apply: security requirements, risk assessment, technical documentation, support period, CE marking and reporting.
Important product, class I
You can check it yourselves only if you follow the EU standards in full
For class I, makers may check the product themselves only if they apply the official EU standards for the CRA in full. An EU certification scheme also works. Otherwise an approved independent body (a notified body) must check it. Find out whether those standards exist yet before you rely on them.
Important product, class II
Your product needs independent conformity assessment
Makers cannot check class II products themselves. An approved independent body (a notified body) must assess them, or you need an EU security certificate at the required level. Free and open-source software in this class has its own route.
Critical product
Your product is in the strictest group
The EU can require an EU cybersecurity certificate for critical products. Where it has not, an approved independent body must check the product, as for class II.
Not covered
Another EU law covers this product
These two regulations cover medical devices, so the CRA does not apply to them at all.
Not covered
Another EU law covers this product
A medical device with a CE mark falls under the medical device rules, so the CRA does not apply. The CRA’s own wearables class covers only devices those rules don’t.
Not covered
Another EU law covers this product
Vehicles under Regulation (EU) 2019/2144 or (EU) No 168/2013, and parts designed only for them, are outside the CRA. That holds whether you sell to the vehicle maker or to another firm in the car supply chain. Generic parts, and parts sold to the public, are covered. Powered cycles designed to pedal (category L1e) stay under the CRA.
Not covered
Another EU law covers this product
Products certified under Regulation (EU) 2018/1139 are outside the CRA. The exception is narrower than “aviation”: uncertified equipment used near aviation is still covered by the CRA.
Not covered
Another EU law covers this product
Marine equipment within Directive 2014/90/EU is outside the CRA.
Not covered
Another EU law covers this product
Products developed or changed only for national security or defence, or built to handle classified information, are outside the CRA. The word “only” is strict: what counts is why the product was made, not who buys it.
Not covered
A narrow spare parts exception covers this product
Spare parts that replace identical parts, made to the same specifications, are outside the CRA. This is a narrow exception in the CRA itself, so confirm it applies before you rely on it.
Probably not covered
The CRA does not cover services
The CRA covers products put on sale, not services. Consulting, setup, maintenance and staff on hire don’t make you a manufacturer.
Importer duties
You have an importer’s duties
An importer is the first to sell a product in the EU. Before selling, check the maker ran the required check, the CE mark is on it and the documents and instructions exist. You may not sell a product you know doesn’t meet the rules.
Distributor duties
You have a distributor’s duties, not a manufacturer’s
They are lighter, but real. Check the product has the CE mark and comes with the required documents and instructions. Don’t sell products you know don’t meet the rules, and tell the maker and the authorities if one poses a significant security risk.
Not settled yet
The law hasn’t settled this case yet
Under the law, whoever sells a product under its own brand is its manufacturer, so here that is usually the client. The Commission’s guidance says nothing about work built to order. One of its examples says that licensing source code to another company places it on the market.
Not covered
A browser-only service is not covered
Software used only in a web browser, serving no product, is outside the CRA. Cloud services fall under NIS2, the EU’s security law for important services, instead.
Not covered for now
The CRA covers only products offered in the EU
As long as the product is not offered in the EU or the wider European Economic Area, you have no manufacturer’s duties.
Not covered
A system built for your own use is not put on sale
The CRA applies to businesses only for the products they make available to others.
Not covered
A product with no data connection is outside the CRA
The CRA covers products meant to connect to a device or a network, directly or indirectly.
Not covered
Another EU law covers this product
Not put on sale
Free-to-download software is not seen as put on sale
What matters is whether people must pay to get the software itself or its updates, not whether you earn money from services around it. If anyone can download and install it freely, and services are bought separately, you have no manufacturer’s duties. Ads, or personal data required as the price of use, would change that.
This result rests on answers you weren’t sure about:
- What you sell
- Whose brand is on it
- Who brings it into the EU
- What you hand over
- How customers get it
- Whether a product needs it
- Whether it reaches the EU
- How it connects
- Other EU laws
- Who can buy the part
- Open source
- Product type
- Main purpose
- Attack resistance level
- SIEM or SOAR
- Where it is used
- Toy features
- What the wearable is for
- What the chip protects
- What the assistant does
- Router or firewall
- Company size
- Part of a group
- Planned changes
- Support period
- Parts made by others
How much the CRA asks of you
Level {n} of {total}: Outside the CRA
From your answers, the CRA gives you no duties for this product.
Level {n} of {total}: Lighter duties
The CRA applies to you, but in a role with fewer duties than a manufacturer.
Level {n} of {total}: Manufacturer duties
You can assess conformity internally, but the full set of manufacturer duties applies.
Level {n} of {total}: Important product
The product is in a stricter class and may need independent conformity assessment.
Level {n} of {total}: Critical product
The product is in the strictest group and needs the most preparation.
Provisional until the answers you weren’t sure about are confirmed.
- Your role
- Manufacturer
- To confirm
- You make the product available in the EU under your name.
- Product class
- Standard
- Not on the EU’s lists of important or critical products.
- Conformity assessment
- Done by you
- The route works today
- Your role
- Manufacturer
- To confirm
- You make the product available in the EU under your name.
- Product class
- Important, class I
- On the EU’s list of important products.
- Conformity assessment
- Independent, in most cases
- Yourselves only with the EU standards
- Your role
- Manufacturer
- To confirm
- You make the product available in the EU under your name.
- Product class
- Important, class II
- On the EU’s list of important products.
- Conformity assessment
- Independent
- By an approved body
- Your role
- Manufacturer
- To confirm
- You make the product available in the EU under your name.
- Product class
- Critical
- On the EU’s list of critical products.
- Conformity assessment
- Independent
- Or an EU certificate where required
- Rules that apply
- Medical device rules
- Regulation (EU) 2017/745 (MDR) or 2017/746 (IVDR)
- Next step
- Confirm the exception
- Rules that apply
- Medical device rules
- Regulation (EU) 2017/745 (MDR) or 2017/746 (IVDR)
- Next step
- Confirm the exception
- Rules that apply
- Vehicle type-approval rules
- Regulation (EU) 2019/2144, or Regulation (EU) No 168/2013
- Next step
- Confirm the exception
- Rules that apply
- Aviation safety rules
- Regulation (EU) 2018/1139, with Regulations (EU) 2022/1645 and 2023/203
- Next step
- Confirm the exception
- Rules that apply
- Marine equipment rules
- Directive 2014/90/EU on marine equipment
- Next step
- Confirm the exception
- Rules that apply
- Defence and national security
- The CRA’s own exception for defence and national security
- Next step
- Confirm the exception
- Rules that apply
- The CRA’s spare parts exception
- An exception inside the CRA itself
- Next step
- Confirm the exception
- Your role
- Service provider
- To confirm
- Next step
- Check your boundaries
- Your role
- Importer
- To confirm
- Next step
- Check your suppliers’ documents
- Your role
- Distributor
- To confirm
- Next step
- Confirm your role
- Your role
- Not settled
- To confirm
- Next step
- Settle it in your contracts
- Your role
- Online service provider
- To confirm
- Next step
- Check NIS2 instead
- Your role
- Outside the EU market
- To confirm
- Next step
- Plan before your first EU sale
- Your role
- Internal use only
- To confirm
- Next step
- Watch for the change to a product
- Your role
- Not connected
- To confirm
- Next step
- Check every way it connects
- Your role
- Covered by other rules
- To confirm
- Next step
- Confirm the exception
- Your role
- Open-source steward, probably
- To confirm
- Next step
- Confirm your steward duties
