Is Your Product In Scope? Use the Free CRA Scope Assessment Tool

The European Union’s Cyber Resilience Act is officially live, and it’s completely changing the rules for digital products. If your company builds, imports, or distributes software or connected hardware (referred to as “Products with Digital Elements” or PDEs) for the EU market, compliance is no longer optional, it’s a legal necessity.

But navigating hundreds of pages of regulatory text to find your exact requirements is a massive headache. Are you legally considered a manufacturer or an importer? Is your product a default PDE, or does it fall into a high-risk category?

To give you instant regulatory clarity without the expensive legal retainer, we’ve developed an interactive CRA Scope Assessment tool. While this page hosts the breakdown of how the regulation applies to you, you can launch the interactive wizard directly on the Codific’s website below.

➔ Launch the CRA Scope Assessment Tool Here

Why You Need a CRA Scope Assessment

Placing a digital product on the EU market without meeting CRA requirements carries severe compliance risks, including heavy fines and market recalls. A formal CRA Scope Assessment helps you achieve three critical objectives:

1. Verify Applicability: Determine if your hardware or software is legally recognized as a Product with Digital Elements (PDE).

2. Identify Sector Exclusions: Find out if your product is already exempted due to overlapping sector-specific EU laws.

3. Map Out Obligations: Instantly see your requirements for security-by-design, vulnerability disclosure, and CE marking.

How the CRA Scope Assessment Tool Works

The online assessment takes roughly 3 minutes and guides you through 4 quick steps based directly on the official text of Regulation (EU) 2024/2847. Here is exactly what the tool evaluates:

Step 1: Technical & Territorial Filtering

The tool first determines if your product meets the fundamental criteria of the Cyber Resilience Act. It filters your product through two primary questions:

• The Technical Scope: Is the product hardware or software that processes, transmits, or stores data?

• The Market Scope: Is the product being placed on, or made available to, the European market? (Note: This includes digital software made available for download or cloud access by EU-based users).

Step 2: Excluding Highly Regulated Sectors

The CRA is a horizontal regulation, meaning it applies broadly except where strict, mature cybersecurity frameworks are already in place. The CRA Scope Assessment checks if your product belongs to an excluded category, such as:

• Medical devices (MDR) and in vitro diagnostic devices (IVDR)

• Motor vehicles and their trailers

• Civil aviation products

• Marine equipment

• Products used exclusively for national security or defense

  

Step 3: Pinpointing Your Supply Chain Role

Your legal liabilities shift dramatically depending on your operational role. The wizard maps your specific profile to one of the regulation’s recognized actors:

• Manufacturer: Carries the primary lifecycle obligations (risk assessments, technical files, security updates).

• Importer & Distributor: Responsible for verifying that the manufacturer has met EU standards before placing the item on the market.

• Open-source Steward / Integrator: Unique roles with tailored compliance boundaries under the Act.

Step 4: Product Risk Classification

Not all software and hardware face the same level of regulatory scrutiny. The final phase of the CRA Scope Assessment categorizes your product’s core functionality into its regulatory risk tier:

Your Custom CRA Obligations Manifest

Once you complete the interactive wizard, the tool generates a tailored list of your legal obligations. For primary manufacturers, this includes a strict roadmap of action items:

📋 Core CRA Requirements Checklist:

• Cybersecurity Risk Assessment: Must be conducted and documented before the product hits the market.

• Security by Design: Meeting Annex I requirements, including data minimization, access control, and default secure configurations.

• CE Marking & Technical Files: Drawing up a formal EU Declaration of Conformity and affixing the CE mark.

• Vulnerability Management: Providing security updates for the product’s expected lifetime (minimum 5 years) and reporting actively exploited flaws to ENISA within mandatory legal timeframes.

Take the First Step Toward Compliance

Don’t leave your EU market access to guesswork. Use our optimized scoping framework to find out exactly where your business stands under the new regulations.

➔ Start Your Free CRA Scope Assessment