CRA Scope Check
Two in five companies that have heard of the Cyber Resilience Act have not worked out whether it applies to them, and half cannot tell a manufacturer from an open-source steward. Four questions settle both, with the article behind every answer.
Your situation
Nothing you choose leaves this page. It is a decision tree over the Regulation's own definitions, run in your browser.
What applies to you
Art. 3(13): you develop or manufacture the product, or have it made, and market it under your name or trademark, for payment or free of charge.
An importer or distributor that places a product on the market under its own name or trademark, or substantially modifies a product already on the market, is considered a manufacturer and is subject to Articles 13 and 14.
- Since 11 September 2026
- Report an actively exploited vulnerability or a severe incident to your coordinating CSIRT and ENISA: early warning within 24 hours of awareness, notification within 72 hours, final report after the fix (Art. 14, Art. 71(2)). Products you placed on the market before December 2027 count too (Art. 69(3)).
- From 11 December 2027
- The essential requirements of Annex I, the technical documentation, the conformity assessment and the CE marking (Art. 13).
- Penalties
- A missed Article 13 or 14 duty sits in the top tier: up to €15 million or 2.5% of worldwide annual turnover (Art. 64(2)). As a micro or small enterprise you cannot be fined for missing the 24-hour early warning (Art. 64(10)). The duty to report remains, and so does every other duty.
Three things to do this week
- Register on the ENISA Single Reporting Platform and name a Primary Assigned Representative.
- Know what each product ships: one SBOM per version, kept where the people on call can read it.
- Decide who declares awareness, and where the moment is recorded. The clock counts from that decision.
Art. 3, 'importer': you are established in the EU and place on the market a product that carries the name or trademark of a person established outside the EU.
Your own duties are in Article 19 and apply from 11 December 2027: place only compliant products on the market, check that the manufacturer has done its part, keep the documentation, and tell the manufacturer and the market surveillance authorities when you learn of a vulnerability or a non-compliance.
The Article 14 reporting duty stays with the manufacturer, unless you put your own name on the product or modify it substantially; then it becomes yours (Art. 21).
Worth asking your manufacturer today: who is their Assigned Representative on the ENISA platform, and how will they tell you within 24 hours?
Art. 3, 'distributor': you make a product available on the EU market without affecting its properties, and you are neither its manufacturer nor its importer.
Your own duties are in Article 20 and apply from 11 December 2027: check the CE marking and the documentation before you supply the product, and tell the manufacturer or importer and the market surveillance authorities when you learn of a vulnerability or a non-compliance.
The Article 14 reporting duty stays with the manufacturer, unless you put your own name on the product or modify it substantially; then it becomes yours (Art. 21).
Worth asking your manufacturer today: who is their Assigned Representative on the ENISA platform, and how will they tell you within 24 hours?
Art. 3(14): a legal person, other than a manufacturer, that systematically and on a sustained basis supports the development of specific free and open-source products intended for commercial activities, and ensures their viability.
Article 24 sets your duties: a cybersecurity policy for the project, cooperation with the market surveillance authorities, and the Article 14(1) reporting duty to the extent that you are involved in the development (Art. 24(3)). Stewards cannot be fined (Art. 64(10)).
The general application date is 11 December 2027; ENISA's platform already accepts notifications from stewards. A project that is monetised, or developed by a company as part of its business, makes that company a manufacturer instead.
The Regulation covers products with digital elements (Art. 3(1)). Software offered only as a service is not one, unless it is the remote data processing a product needs to perform one of its functions (Art. 3(2)); then it is part of that product, and the product's manufacturer answers for it.
NIS2 (Directive (EU) 2022/2555) may apply to the service itself. That is a different law with a different reporting regime.
The Regulation applies to products made available in the course of a commercial activity (Art. 3, 'making available on the market'). Developing and publishing free and open-source software without monetising it is not one (recital 18).
It becomes commercial when you charge for the software or for its support beyond covering costs, or when a company develops it as part of its business. Then run this check again as a manufacturer.
Article 2 leaves the product to the law that already covers it: medical devices and in-vitro diagnostics under Regulations (EU) 2017/745 and 2017/746 (Art. 2(2)). motor vehicles type-approved under Regulation (EU) 2019/2144 (Art. 2(2)). products certified under Regulation (EU) 2018/1139 on civil aviation (Art. 2(3)). marine equipment within Directive 2014/90/EU (Art. 2(4)). spare parts that replace identical components and are made to the same specification (Art. 2(6)). products developed or modified exclusively for national security or defence, or designed to process classified information (Art. 2(7)).
Check this per product line. An excluded device next to a gateway or an app that is not excluded does not take the gateway or the app out of scope.
Not legal advice. Every answer names its article in Regulation (EU) 2024/2847; read the article before you act on it. EUR-Lex · Read the Article 14 guide
Why this is the question most companies have not answered
41%
of companies that know the CRA have not determined whether it applies to them.
54%
are still working out the difference between a manufacturer and an open-source steward.
66%
of respondents are unfamiliar with the Regulation, a year after it entered into force.
Source: Linux Foundation / OpenSSF, 2026 CRA Awareness and Readiness Report (June 2026, 843 respondents)
In scope? Then the clock is already running.
ExploitClock watches your SBOMs against the exploited lists every 15 minutes, starts the 24-hour clock when you confirm awareness, drafts the ENISA notification in the platform's own fields and keeps the proof.