Free check · about five minutes

Does the Cyber Resilience Act apply to your product?

Eight questions, one product at a time. Nothing leaves your browser: no account, no e-mail, nothing stored.

General information based on Regulation (EU) 2024/2847, not legal advice. For borderline cases, read our scope guide and ask your lawyer.

01 Is the product sold or otherwise made available to users in the European Union?

Wherever your company is based. "Made available" includes giving it away as part of a commercial activity.

YesNo, never in the EUNot sure

02 What is the product?

A device or machine with software or firmware in itSoftware that customers install, or a mobile appA software or hardware component sold separately (library, SDK, module, firmware)The cloud back end of a device or app that I sellOnly an online service (SaaS), with nothing installed on the customer side

03 Can it connect, directly or indirectly, to a network or another device?

Wi-Fi, Ethernet, Bluetooth, USB, a phone app, a cloud account, an update server… Any data connection counts, even an indirect one.

YesNo, never

04 Is it covered by one of these EU product laws?

None of theseMedical device or in vitro diagnostic deviceMotor vehicle, or a system covered by vehicle type-approvalCivil aviation product certified under EU aviation rulesMarine equipmentDeveloped exclusively for national security or defence

05 How is it supplied?

Sold, or monetised in some way (licences, support, subscriptions, data, ads)Free and open source, developed without any commercial activityWe support open-source software that others use commercially (a foundation, for example)

06 Does it do one of these things?

From Annexes III and IV of the regulation. Pick the first one that fits.

Smartcard or secure element, smart meter gateway, hardware security boxFirewall, intrusion detection or prevention, hypervisor or container runtime, tamper-resistant microprocessor or microcontrollerOperating system, browser, password manager, VPN, antivirus, identity or access management, boot manager, router, modem or switch, network interface, network management, SIEM, PKI, microprocessor or microcontroller with security functions, smart-home assistant, smart lock, security camera, alarm, baby monitor, toy with social-interaction or location-tracking features, health wearable (see Annex III for the full list)None of these

07 What is your role?

We make it, or have it made, and sell it under our name or brandWe bring into the EU a product made outside it, under the maker’s brandWe resell a product already on the EU market

08 How big is your company?

EU definitions: a small enterprise has fewer than 50 staff and a turnover or balance sheet of €10 million or less.

Micro or small enterpriseMedium or large enterprise

This check runs in your browser and needs JavaScript. Our scope guide covers the same questions.

Your result

Based on your answers only, and on the regulation as it stands on 7 November 2026. Not legal advice.

Does the Cyber Resilience Act apply to your product?

Class and conformity assessment

What you must do, and when

Worth knowing

Next step