Updated: 30 March, 2026
17 March, 2026
Who needs to comply with the Cyber Resilience Act (CRA)? In most cases, it is companies that place hardware or software products with digital elements on the EU market as part of a commercial activity, especially manufacturers, importers, and distributors.
That uncertainty is understandable. The CRA does not only affect traditional hardware manufacturers. It can also apply to software products, companies outside the EU that place covered products on the Union market, and retailers that take on a manufacturer role in certain cases. At the same time, some offers, such as certain standalone SaaS services or non-commercial open-source software, may fall outside scope.
That is why the real challenge is not just understanding what the CRA is. It is understanding whether your product, business model, and role in the supply chain bring you within scope.
This guide is designed to answer that question directly. It will help you understand who is in scope under the Cyber Resilience Act, when the main exceptions apply, why your role matters, and what being in scope means in practice.
Key Takeaways
- The Cyber Resilience Act mainly applies to companies that place hardware or software products with digital elements on the EU market as part of a commercial activity.
- In most cases, the main roles in scope are manufacturers, importers, and distributors, but retailers can also be treated as manufacturers in some situations.
- The CRA is not limited to connected devices, it can also apply to standalone software and certain remote services that are necessary for a product to function.
- Some offers fall outside scope, including certain products already covered by other EU rules, some standalone SaaS services, and some non-commercial free and open-source software.
- If the CRA applies to your product, compliance is not a one-time task, it means meeting cybersecurity, documentation, and vulnerability handling obligations across the product lifecycle.
Who is in scope under the Cyber Resilience Act (CRA)?
The CRA mainly applies to economic operators that place products with digital elements on the EU market in the course of a commercial activity. In practice, that usually means manufacturers, importers, and distributors.
Products covered
A product with digital elements can be hardware, software, or certain remote data processing solutions linked to the product. The CRA is therefore not limited to connected devices. It can also apply to software placed on the market separately. Remote functionality can be included where the software is designed by, or under the responsibility of, the manufacturer and the product cannot perform one of its functions without it.
Roles covered
In most cases, the manufacturer is the company that develops a product with digital elements, or has it developed and markets it under its own name or trademark. By contrast, the importer is a company established in the EU that places on the market a product bearing the name or trademark of a company outside the EU. Meanwhile, the distributor is usually the company that makes a covered product available on the Union market without changing its properties.
Commercial activity matters
The key question is not only what the product is, but also how it is supplied. The CRA applies when a product is supplied for distribution or use on the EU market in the course of a commercial activity. That can include payment, monetisation, paid support beyond cost recovery, certain platform models, or requiring personal data for reasons beyond security, compatibility, or interoperability.
Main exceptions
Some products and situations fall outside scope. The CRA does not apply where another EU regime already covers the product. It also excludes products developed or modified exclusively for national security or defence purposes, products specifically designed to process classified information, and certain spare parts made only to replace identical components. Products developed or modified by a public administration exclusively for its own use are also not considered to be made available on the market.
SaaS and open-source edge cases
Standalone cloud services are generally outside scope. However, a remote service can still fall within scope if it is necessary for a product with digital elements to perform one of its functions and is designed or developed by, or on behalf of, the manufacturer.
Free and open-source software is also not automatically in scope. It generally falls outside the CRA when it is not made available on the market in the course of a commercial activity. Simply hosting software in an open repository does not by itself count as making it available on the market.
In simple terms, you are most likely in scope if you place a hardware or software product on the EU market as part of a commercial activity, and no clear exception applies.
Does the Cyber Resilience Act (CRA) apply to you? 5 questions to check
Use these questions as a quick first check.
1. Are you placing a hardware or software product on the EU market?
If yes, the CRA may apply. This includes both physical products and software offered in the EU.
2. Is the digital functionality part of the product?
The CRA covers products whose digital functionality is part of what the user receives and depends on. In some cases, this can also include remote functionality that is necessary for the product to work.
3. What is your role?
Check whether you act as the manufacturer, importer, or distributor. Your role matters because the CRA assigns different responsibilities to each one.
4. Is this part of a commercial activity?
The CRA is not limited to products sold for a price. It can also apply where the product is monetised through support, platforms, or other commercial models.
5. Does a clear exception apply?
Some products fall outside scope, such as certain products covered by other EU regimes, some standalone SaaS services, and some non-commercial free and open-source software.
How to read your answer
If your answer is mostly yes, and no clear exception applies, the CRA likely deserves your attention. The next step is to identify your role in the supply chain and review the obligations that come with it.
Why role matters under the Cyber Resilience Act (CRA)
The CRA does not assign the same duties to every company. What you need to do depends on whether you act as the manufacturer, importer, or distributor.
Manufacturer
Manufacturers have the broadest responsibilities.
If you develop a product with digital elements, or have it developed and place it on the market under your name or trademark, you are usually the manufacturer.
In practice, manufacturers must:
- Build the product to meet the CRA’s cybersecurity requirements.
- Assess cybersecurity risks.
- Prepare the technical documentation.
- Complete the conformity assessment.
- Draw up the EU declaration of conformity.
- Affix the CE marking.
- Put vulnerability handling processes in place.
- Provide security updates and support during the support period.
Basically, the manufacturer is responsible for secure design, compliance, and ongoing product security.
Importer
Importers have a control role.
If you are established in the EU and place on the market a product from a company outside the EU, you are usually the importer.
In practice, importers must:
- Check that the manufacturer completed the conformity assessment.
- Check that the technical documentation exists.
- Check that the product bears the CE marking.
- Check that the required instructions and compliance documents are included.
- Only place compliant products on the market.
- Take corrective action if they believe a product is not compliant.
To summarize, importers must verify that the manufacturer has done the required compliance work before the product enters the EU market.
Distributor
Distributors have lighter duties, but they still have responsibilities.
If you make a covered product available on the EU market without changing it, you are usually the distributor.
In practice, distributors must:
- Check that the product bears the CE marking.
- Check that the required information and documents are present.
- Avoid making a product available if they know, or have reason to believe, that it is not compliant.
- Help with corrective action where needed.
Put simply, distributors cannot ignore obvious compliance problems.
When a retailer becomes a manufacturer
Retailers are not a separate role under the CRA. In most cases, they act as distributors.
However, a retailer is treated as a manufacturer if it places the product on the market under its own name or trademark, or makes a substantial modification to the product.
When that happens, the retailer takes on the manufacturer’s responsibilities.
Why this matters
Two companies can sell the same product in the EU and still have very different obligations under the CRA. It is not enough to ask whether the CRA applies to your product. You also need to ask what role your company plays, because that determines what the CRA expects from you.
Here is a quick summary of how responsibilities differ depending on your role under the CRA:
| Role | Who they are | Main CRA responsibilities |
|---|---|---|
| Manufacturer | Develops the product, or has it developed, and places it on the market under its own name or trademark. | Meet the CRA’s cybersecurity requirements, assess risks, prepare technical documentation, complete the conformity assessment, draw up the EU declaration of conformity, affix the CE marking, handle vulnerabilities, and provide security updates during the support period. |
| Importer | EU-based company that places on the market a product from a company outside the EU. | Check that the manufacturer completed the conformity assessment, verify that the technical documentation exists, check the CE marking and required information, place only compliant products on the market, and take corrective action if needed. |
| Distributor | Makes a covered product available on the EU market without changing it. | Check that the CE marking and required information are present, avoid making available products they know or believe are non-compliant, and help with corrective action where needed. |
| Retailer acting as manufacturer | Retailer that places the product on the market under its own name or trademark, or makes a substantial modification to it. | Takes on the manufacturer’s responsibilities for that product. |
What being in scope in the Cyber Resilience Act (CRA) means in practice
If your product is in scope, the CRA creates obligations before and after the product is placed on the EU market.
What the CRA requires
Before placing the product on the market, the responsible party must make sure the product meets the CRA’s essential cybersecurity requirements. That includes secure design, risk assessment, technical documentation, conformity assessment, and the required compliance documents.
For many products, that also means preparing the EU declaration of conformity and affixing the CE marking.
The CRA also goes beyond launch. Manufacturers must handle vulnerabilities, provide security updates during the support period, and meet certain reporting duties for actively exploited vulnerabilities and severe incidents.
What to do next
Start by identifying which products may be in scope. Then confirm your role for each product, because the obligations differ for manufacturers, importers, and distributors.
After that, review your current practices against the CRA. Focus on product security, vulnerability handling, documentation, update processes, and your ability to show compliance if asked.
If you want a more detailed breakdown of the preparation steps, read our guide on how to prepare for the CRA.
For products that look out of scope, document why. If it looks in scope, treat the CRA as a product and compliance workstream, not just a legal question. Being in scope means you need to build cybersecurity into the product, prove that you have done so, and maintain that approach after the product enters the EU market.
Want a tool that can streamline your CRA compliance? Check out SAMMY
Conclusion
The Cyber Resilience Act does not apply to every digital business, but it applies more broadly than many companies expect. If you place a hardware or software product on the EU market as part of a commercial activity, the CRA may be relevant to you.
The key is to look at three things: the product, your role, and whether a clear exception applies. Once you know where you stand, the next step is to treat CRA compliance as a practical product and governance issue, not just a legal one.
In other words, the sooner you clarify whether the CRA applies, the easier it becomes to plan for compliance before deadlines and enforcement pressure make the work harder.
Are you ready for CRA?
With the CRA Framework in SAMMY, you can assess CRA compliance for your different products. The questions and quality criteria give you a complete checklist of everything that is required by CRA. SAMMY also makes it easy to compare products groups, manage compliance roadmaps and collaborate with team members.
Find out more about the SAMMY tool for CRA assessments.
Official resources
