What products does the CRA cover?

It covers products with digital elements — any hardware or software that can connect to a device or network — placed on the EU market. Pure SaaS not sold as a product, products already governed by sector law like medical devices, and non-commercial open source are generally excluded.

What are the CRA risk classes?

Default (non-critical) products self-assess. Important Class I products may self-assess only if a harmonised standard is fully applied, else need a third party. Important Class II products always need a notified body. Critical products may additionally require European cybersecurity certification.

What is the conformity-assessment route for Class II?

Class II products such as hypervisors, industrial firewalls, and secure microcontrollers require third-party conformity assessment by a notified body — internal self-declaration is not sufficient regardless of which standards you apply.

What are the reporting deadlines?

Manufacturers must send an early warning about an actively exploited vulnerability or severe incident to ENISA within 24 hours, a fuller notification within 72 hours, and a final report within 14 days, alongside providing free security updates for the support period.

When does the CRA apply?

The regulation phases in: vulnerability and incident reporting obligations apply from around September 2026, and the full set of requirements including CE marking and conformity assessment apply from around December 2027.

What is the EU Cyber Resilience Act (CRA) Applicability Checker?

Select a hardware or software product to determine EU Cyber Resilience Act applicability and risk class (Default, Important Class I, Class II, or Critical), the required conformity-assessment route, vulnerability-disclosure duties, CE marking, and reporting deadlines. Runs entirely in your browser. It runs free in your browser on Gera Tools, with nothing uploaded.

EU Cyber Resilience Act (CRA) Applicability Checker

Name: EU Cyber Resilience Act (CRA) Applicability Checker
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

The EU Cyber Resilience Act sets mandatory cybersecurity requirements for almost every connected hardware and software product sold in the EU. This checker maps your product to its CRA risk class and tells you which conformity route, security obligations, and reporting deadlines apply.

How it works

The CRA classifies each product with digital elements into a risk tier, and the tier determines how you prove conformity:

Default       → self-assessment (internal control)
Class I       → self-assessment only if a harmonised standard is applied,
                otherwise third-party assessment
Class II      → notified-body (third-party) assessment is mandatory
Critical      → European cybersecurity certification may also be required

Password managers, VPNs, browsers, antivirus and home routers are Class I. Hypervisors, industrial firewalls and secure microcontrollers are Class II. Hardware security modules, smart-meter gateways and secure-element smartcards are Critical. Everything else connected is Default.

Obligations that apply to every in-scope product

Regardless of risk class, every manufacturer whose product is in scope must meet a common floor of obligations under the CRA:

Secure by design — cybersecurity must be considered from the outset of design and development, not added as an afterthought.
No known exploitable vulnerabilities — products may not be placed on the market with known exploitable vulnerabilities.
Security updates — manufacturers must provide free security updates throughout the support period, which is typically at least five years, and communicate clearly when support ends.
Vulnerability disclosure — a coordinated vulnerability disclosure (CVD) process must be established, allowing security researchers to report issues.
Incident and vulnerability reporting — actively exploited vulnerabilities must be reported to ENISA (and optionally to the national CSIRT) within 24 hours of discovery, a fuller notification within 72 hours, and a final report within 14 days.
Software Bill of Materials (SBOM) — an SBOM must be available in machine-readable format, listing software components and their versions.
CE marking — products that pass the applicable conformity assessment must carry the CE mark and an EU declaration of conformity before being placed on the market.
Market surveillance cooperation — manufacturers must cooperate with market surveillance authorities and provide information on request.

Notes and example

A vendor shipping a password manager lands in Important Class I: it can self-assess only if it fully applies a relevant harmonised standard, otherwise it needs a notified body. This means the harmonised standard chosen must be applied fully and correctly — partial compliance does not qualify for the self-assessment route.

Treat the product-category lists in the CRA annexes as a baseline. Delegated acts and implementing acts issued by the European Commission can add or reclassify products after the regulation enters force, so confirm the current annex against the published Official Journal text before finalising your compliance plan. The phased timeline also means vulnerability reporting obligations apply before the full set of requirements, so compliance planning should address each phase separately.