CRA Scope and Exclusions
Before you take any compliance measure, you need to know whether the Cyber Resilience Act applies to your product at all. This page explains when the CRA covers a specific device, machine, or piece of software, and where exclusions apply. Defining the scope correctly is the first step of any compliance work, because it determines effort, responsibilities, and obligations.
The CRA applies to products with digital elements made available on the market whose use includes a direct or indirect data connection to a device or network. A product with digital elements is a software or hardware product, including its remote data processing solutions. The CRA therefore covers connected products, not every piece of software and hardware.
Contents
Which products does the Cyber Resilience Act apply to?
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, sets its basic rule in Article 2(1) of Regulation (EU) 2024/2847:
“This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.”
So the CRA does not cover every piece of software and hardware. It covers connected products.
The basic rule: connected products with digital elements
The scope depends on two conditions:
- There must be a product with digital elements.
- That product must include a data connection to a device or network.
A product with digital elements is a software or hardware product and its remote data processing solutions. This includes software or hardware components placed on the market separately. The term is therefore broad. It ranges from an embedded controller and a machine control system to a software library sold on its own.
The second condition, the data connection, is the deciding one. The CRA distinguishes several forms:
- A logical connection is a virtual representation of a data connection implemented through a software interface.
- A physical connection is a connection implemented by physical means, such as electrical, optical, or mechanical interfaces, wires, or radio waves.
- An indirect connection is a connection to a device or network that does not take place directly. It exists as part of a larger system that can itself be connected directly to that device or network.
These definitions are not legal theory for its own sake. They decide whether the CRA applies. Take a connected machine controller in intralogistics that sends status data to a higher-level control system. It is clearly in scope: it is a product with digital elements, and it includes a logical and a physical data connection. For how the scope question fits into the regulation as a whole, see our Cyber Resilience Act overview.
Which products are excluded from the CRA?
The CRA excludes several product groups because they already fall under sector-specific Union rules with their own cybersecurity requirements. Article 2(2) to (7) of the CRA lists these exclusions.
| Excluded products | Legal act | CRA provision |
|---|---|---|
| Medical devices | Regulation (EU) 2017/745 | Article 2(2)(a) |
| In vitro diagnostic medical devices | Regulation (EU) 2017/746 | Article 2(2)(b) |
| Motor vehicles | Regulation (EU) 2019/2144 | Article 2(2)(c) |
| Products certified under civil aviation rules | Regulation (EU) 2018/1139 | Article 2(3) |
| Marine equipment | Directive 2014/90/EU | Article 2(4) |
| Spare parts (identical components, same specifications) | No sectoral act | Article 2(6) |
| National security, defense, classified information | No sectoral act | Article 2(7) |
The first five exclusions share a common idea: products that already fall under sector-specific rules are not also subject to the CRA.
The spare parts exclusion applies only if the part replaces an identical component and is manufactured to the same specifications as the component it is intended to replace.
Products developed or modified exclusively for national security or defense purposes are also excluded. The same applies to products specifically designed to process classified information.
Article 2(5) has a special role. It covers products with digital elements that fall under other Union rules addressing all or some of the risks covered by the essential cybersecurity requirements in Annex I. For these products, the application of the CRA can be limited or excluded. Two conditions apply: the step must be consistent with the applicable regulatory framework, and the sectoral rules must achieve the same or a higher level of protection than the CRA. The Commission specifies this through delegated acts. This clause is therefore not an automatic exemption but a regulated mechanism for future adjustments.
In practice, the sectoral exclusions raise boundary questions. For connected medical devices, responsibility shifts to the framework of the Medical Device Regulation (MDR). Our article on MDR cybersecurity reporting obligations explains how the EU intends to close the CRA gap for medical devices. For connected machinery, the question is how the Machinery Regulation and the CRA work together. Radio products touch the boundary with the Radio Equipment Directive, which we cover in our article on the repeal of the RED Delegated Act.
Open-source software: when it is covered and when it is not
Free and open-source software is neither excluded across the board nor covered across the board. What matters is how it is made available. Under the CRA, free and open-source software is software whose source code is openly shared and which is made available under a free and open-source license. That license must provide for all rights to make the software freely accessible, usable, modifiable, and redistributable.
The deciding threshold is commercial activity. According to the recitals of the regulation, only free and open-source software that is made available on the market falls within scope. This means software supplied for distribution or use in the course of a commercial activity. Software that its manufacturers do not monetize is not considered a commercial activity for the purposes of the regulation.
The open-source software steward has its own, lighter role. A steward is a legal person, other than a manufacturer, that systematically supports the development of such software on a sustained basis. The software must be intended for commercial activities, and the steward ensures its viability. The CRA provides a simplified regime for this role. We cover the details, such as exactly when the commercial activity threshold is crossed, in our article on open-source software under the CRA.
Cloud and SaaS: the test for remote data processing solutions
For cloud and SaaS components, too, the question is not whether they are connected but whether they are tied to a product. The CRA does not cover remote data processing solutions as stand-alone services. It covers them only when they are functionally tied to a product.
The test follows from two definitions working together. First, a product with digital elements expressly includes its remote data processing solutions. Second, remote data processing means data processing at a distance for which the manufacturer designs and develops the software, or has it done under its responsibility. Without this processing, the product could not perform one of its functions. Both conditions must be met: the manufacturer is responsible for the software, and the product cannot do without it.
This gives the dividing line. A cloud component operated by the manufacturer, without which a connected machine could not perform one of its functions, is part of the product. The CRA therefore covers it. A stand-alone SaaS or cloud service without this link to a product does not fall under the CRA. Such services can fall under other laws, such as the NIS2 Directive. This distinction needs a separate assessment.
Borderline cases in practice
Three situations show how the rules work in practice:
- Device without a data connection: A dishwasher with no connectivity at all processes data digitally. However, it does not include any direct or indirect, logical or physical data connection to a device or network. The second condition of Article 2(1) is therefore missing, and the dishwasher is not covered by the CRA.
- Wearable without any data interface: The same applies here. Without an intended data connection, the CRA does not apply. As soon as the wearable pairs with another device, for example via Bluetooth, there is a physical connection and the assessment changes.
- Software libraries and components placed on the market separately: Article 3, point (1), expressly brings such separately placed software or hardware components into the definition of a product. Article 3, point (6), defines a component as software or hardware intended for integration into an electronic information system. A library offered on its own can therefore itself be a product with digital elements.
After the scope check
Once you know that your product falls under the CRA, the next question is how far your implementation has come. Not sure where your products and processes stand? In a short call, we can look at it together.