Products with Digital Elements: Scope & Classification

Cyber Resilience Act compliance handled end to end: scope, gap analysis, controls, evidence and a clear roadmap with expert EU support.

Speak to a GRC expert

If you have any questions or need assistance, please don't hesitate to contact us.

Share on social media

Explore Our Services

We offer a comprehensive suite of cybersecurity and compliance services to help you protect your business and meet regulatory requirements.

Scope Confidence Lens

Clarify whether your product, role, software, component, or market activity needs CRA readiness review.

Digital Products

Assess software, hardware, firmware, and connected components.

EU Market

Review products offered within EU market channels.

Manufacturer Duties

Identify security responsibilities across product lifecycle activities.

Importer Roles

Check obligations linked to imported digital products.

Distributor Exposure

Confirm resale responsibilities before placing products commercially.

Exclusion Review

Validate possible exclusions against official requirements carefully.

Manufacturer Readiness

Prepare secure design, documentation, updates, vulnerability handling, and conformity evidence.

Importer Review

Confirm product security information, documentation, responsibilities, and market readiness.

Distributor Checks

Verify product markings, instructions, support information, and security assurances.

Scope Trigger Map

Identify product, market, connection, role, and modification triggers before planning CRA readiness work.

EU Market

Products offered in EU channels may trigger readiness.

Digital Elements

Software, hardware, and connected components require review.

Data Connection

Network or device connections may create scope.

Commercial Supply

Products supplied commercially may require readiness assessment.

Economic Role

Manufacturers, importers, and distributors carry different responsibilities.

Product Modification

Substantial changes may trigger fresh readiness obligations.

Support Period

Expected product use influences update responsibilities.

Common Edge Case Triggers

Non Commercial Use
Internal prototypes may need separate legal and scope validation.
Excluded Product Areas
Counsel Confirmation Needed

Confirming CRA Exclusions With Confidence

Confirming CRA Exclusions With Confidence

Clarify reasonable exclusions carefully before relying on any out-of-scope position commercially or operationally internally.

Continue Reading

Ready to learn more about Secure-by-Design Product Security Requirements?