Is your product in scope for the EU Cyber Resilience Act?

Question 2 of 6

How is your product delivered? Select all that apply.

The dividing line is whether something is installed or shipped versus consumed purely as a website.

Question 3 of 6

Is your back-end required for a separate product to work?

Pure cloud services sit outside the CRA — unless they are the remote data-processing a shipped product depends on to function.

Question 4 of 6

Is the product free and open-source, outside any commercial activity?

Non-commercial open-source software is carved out. Monetised or commercially-supported open source is not.

Question 5 of 6

Is the product already covered by a sector law with its own cyber rules?

Medical devices (MDR), motor vehicles, aviation (EASA) and marine equipment have their own regimes and sit outside the CRA.

Question 6 of 6

Which of these best describes what it does?

Your real Annex III/IV category (not just "is it security-related") is what actually sets your conformity route — a firewall and an HSM are both "security", but land on different routes.