Regulation (EU) 2024/2847 — Self-assessment

Where do you stand with the Cyber Resilience Act?

About 5 minutes. Five steps to situate your product: scope, classification, applicable deadlines and the gaps to address first.

Step 1 of 5

Your activity: estimating whether your product falls within the scope of the CRA.

Is the product you are assessing itself covered by one of the following regulations or situations?

Some products already covered by sector-specific European legislation are excluded from the CRA. Careful: it is the regime applicable to the specific product, not the company’s sector of activity, that determines the exclusion.

No — none of these cases (software, digital service or connected product, any sector of activity)

Yes — medical device covered by Regulation (EU) 2017/745 (MDR)

Yes — in vitro diagnostic device covered by Regulation (EU) 2017/746 (IVDR)

Yes — product covered by vehicle type-approval — Regulation (EU) 2019/2144

Yes — aeronautical product certified in accordance with Regulation (EU) 2018/1139

Yes — marine equipment covered by Directive 2014/90/EU

Yes — product developed exclusively for defence or national-security purposes, or designed to process classified information

Yes — spare part replacing an identical component, manufactured to the same specifications as the component it replaces

The result of this self-assessment is indicative and does not constitute legal advice. Under the CRA, qualification is assessed product by product — not by company or by sector — and according to the product’s main function (Art. 7; further detail in Implementing Regulation (EU) 2025/2392). In line with the GDPR, this form contains no gamification mechanics and your data is used solely for the analysis of your situation