Does the Cyber Resilience Act apply to your product?
Five questions about what you ship and where you sell it. No sign-up, and nothing is stored unless you ask us to.
Question 1 of 5
What do you ship?
The Regulation covers products with digital elements, not services.
What the check actually tests
The Regulation applies to a product with digital elements that is made available on the Union market.Art. 2(1) The check asks four things that follow from that sentence, and one that follows from the annexes.
Is it a product?Art. 3(1)
Installed software, firmware, a device, a library or an app is. A hosted service on its own generally is not, unless it is the remote data processing part of a product.
Is it on the EU market?Art. 2(1)
Directly or through a distributor, importer or app store. Where the company sits does not matter; where the product is sold does.
Where is the company established?Art. 14(7)
This decides which national CSIRT receives a report, by the cascade in Article 14(7): establishment, then representative, importer, distributor, then users.
Is it still supported?Art. 69(3)
Duties apply to products already on the market while they are in support. There is no exemption for having shipped early.
Is it in Annex III or IV?Annex III
The product class. It changes the conformity route and whether a notified body is involved. It never changes a reporting deadline.
The four answers it can give
- In scope
- Every question resolved to a duty, with the article for each part.
- Likely in scope
- A duty on the facts given, with one of them still to happen or to be confirmed, such as an EU launch that is planned.
- Unlikely to be in scope
- A hosted service with nothing installed by the customer. The article is cited so a lawyer can check the exception.
- Out of scope
- Not made available on the EU market. The answer that would change it is named.
Every verdict cites the article each reason rests on, and a shared result is a permanent page a lawyer can read without running anything. It is not legal advice, and it says so on every result.
Questions people arrive with
- Does the Cyber Resilience Act apply to software, or only to hardware?
- Both. It applies to any product with digital elements placed on the EU market: installed software, firmware, connected devices, libraries and SDKs, and mobile apps. A purely hosted service is generally outside it, unless it is the remote data processing part of a product that is placed on the market.
- We are not based in the EU. Does it still apply?
- Yes. The Regulation applies by market, not by domicile. A manufacturer outside the EU that makes a product available there carries the same duties, and reports through the member state of its most significant connection.
- Our product was released before the Regulation. Is it exempt?
- No. The reporting duty applies to products already on the market for as long as they remain within their support period. A product that is genuinely end of life falls away; one placed on the market early does not.
- What does the check store?
- Nothing, unless you ask for a shareable link. Then it stores the answers and the verdict under a random id, and never a name or an address.
If the answer is yes, the next question is what the duty requires: Article 14 in plain language, the dates, and where the report goes.
This produces evidence, timelines and drafts. It is not legal advice, and you remain the party responsible for reporting.