Regulation (EU) 2024/2847 · Cyber Resilience Act
Does the EU Cyber Resilience Act apply to your software?
Nine questions. A verdict on scope, your economic-operator role and product class — every rule citing the article it comes from.
Free · no sign-up · not legal advice
Likely in scope
Confidence: High — a well-defined path through the decision tree, no borderline markers.
Manufacturer
Default
11 Sep 2026
11 Dec 2027
Assessment engine v1.5.0 · Guidance updated Aug 2026
Every rule cites the article or annex it derives from.
Deterministic rule tables. No language model in the decision.
Citations checked against EUR-Lex; the build fails on an unverified one.
scope-logic v1.5.0 · 174 tests · exhaustive over all answer paths.
The deadline everyone quotes is the second one.
Article 14 reporting obligations arrive more than a year before the essential requirements. Both apply to every product in scope, whatever its class.
What the reporting obligations requireArticle 14 · Article 71
11 Sep 2026
CRA Article 14 reporting obligations are in effect since 11 September 2026. Check whether they apply to your product.
Article 71
11 Dec 2027
Essential requirements of Annex I, technical documentation, conformity assessment and CE marking.
Nine questions. Cited sources. A verdict you can audit.
About two minutes.
The verdict is on the page; email only if you want the PDF.
What are you checking?
Step 1 of 9
A decision tree you can read, not a model you have to trust.
V-DEFAULT-IN-SCOPE q1 = software · q2 = eu-market q3 = commercial → Likely in scope · Art. 2, 3
Rules are data
Six tables — verdict, confidence, role, class, dates, findings. The first matching rule wins, and the same answers always give the same result.
Regulation (EU) 2024/2847 Article 3 · remote data processing state: verified · 2026-08-24 source: EUR-Lex OJ L 2024/2847
Every rule cites its source
Each rule points to the article or annex it derives from. A test enforces it: an unverified citation fails the build.
High — no borderline marker crossed.
Medium — at least one boundary the Regulation leaves to case-by-case analysis.
Uncertainty is stated, not hidden
Status answers what; confidence answers how certain. Edge cases are called edge cases.
Scope is the first question. Evidence is the work.
We are building continuous CRA readiness for software products: connect a repository, map Annex I requirements to engineering controls, collect evidence per release, keep technical documentation current. Same principle as the checker — every claim cites its source.
- Annex I · Part I · 2(a) secure by default
- Annex I · Part II · 1 SBOM per release
- Article 13 risk assessment
- Annex VII technical documentation
- Article 14 reporting workflow
Early access · in development
Common questions
- Does the Cyber Resilience Act apply to SaaS?
Mostly no for pure browser-based SaaS — but yes the moment your product includes anything that runs on the customer's side (an app, agent, CLI, plugin), or cloud processing your shipped product needs to function ("remote data processing", Article 3(2)). The boundary cases are common enough that we built this checker. Full explanation →
- When do I actually need to comply?
Two dates (Article 71): 11 September 2026 — reporting obligations for actively exploited vulnerabilities and severe incidents (24h early warning), in force since 11 September 2026. 11 December 2027 — everything else: essential security requirements, technical documentation, conformity assessment, CE marking. Evidence for the second date is built during 2026-2027, not in December 2027. What the September 2026 obligations require →
- We're not an EU company. Does it still apply?
If you make your product available on the EU market, yes. The trigger is where your product is sold or distributed, not where you are incorporated. Non-EU manufacturers have additional practical questions (reporting routes, possibly an authorised representative), but "we're not European" is not an exemption. How the scope test actually works →
- What happens if we ignore it?
Market surveillance authorities can require corrective measures, restrict or withdraw products from the EU market, and impose administrative fines — up to €15 million or 2.5% of global annual turnover (whichever is higher) for breaches of the essential requirements. Enforcement intensity will vary; the loss of EU market access is the risk that matters commercially. The phased checklist for getting ahead of it →
- What about open source?
Genuinely non-commercial free and open-source software is largely out of scope, and open-source software stewards have a lighter regime (Articles 3(14) and 24). A steward is any legal person, other than a manufacturer, that provides sustained support for the development of open-source products intended for commercial activities and ensures their viability — there is no requirement to be a non-profit. Monetised open source — dual licensing, paid hosting, commercial support — needs case-by-case analysis, and open-source products in "important" categories keep a self-assessment route if their technical documentation is public (Article 32(5)). The checker handles these branches explicitly. What the product classes change →
- Is this assessment legal advice?
No. It is an automated regulatory assessment: your answers evaluated against the Regulation's criteria and official Commission guidance, with every rule citing its source and a confidence level attached. It is designed to give you an evidence-based starting point — scope, role, product class, dates — not a legal opinion. For formal determinations, consult a qualified professional. Every article cites its sources the same way →