Article 3(2)
SaaS & Remote Data Processing Checker
Separate independent services from remote processing that supports a product function.
Free · No sign-upOpen tool
Scope & Classification Articles 2–3
Does the Cyber Resilience Act apply to your product?
Check product scope, EU market relevance, exclusions and your likely economic role. Get a qualified result, follow the reasoning and see what to do next.
Answers stay in your browser. No account or storage.
How to use this assessment
A product is likely within CRA scope when it is a product with digital elements supplied on the EU market in a commercial activity, has the relevant direct or indirect data connection, and is not covered by an exclusion.
Use facts about the specific product, version and supply arrangement. If you cannot establish a condition, select the uncertainty option. The result identifies the limits of the assessment and the evidence needed for your next decision.
Read the guide: Scope & economic rolesSaaS & cloud servicesMobile appsIoT & connected devicesSoftware libraries
Frequently asked questions
Is a software library a product?
A separately supplied software component can be a product with digital elements. Its commercial supply and any FOSS treatment still need to be assessed.
Does a cloud dependency always fall within scope?
No. The definition requires a functional dependency and software designed or developed by or under the responsibility of the manufacturer. It is not enough that a service is useful to the business.