Does The EU Cyber Resilience Act Apply To Your Product? Scope, Definitions And The Product Classification System Explained

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) (the “CRA”) entered into force on 10 December 2024 and will apply in full from 11 December 2027. On 27 July 2026, the EU Commission published its long-awaited guidance on the CRA (C(2026) 5252), clarifying how it applies in practice. For businesses that design, develop or sell hardware or software in the EU, the first and most critical question is whether – and at what tier – the CRA catches their products. Below we unpack the scope, key definitions and the three-tier product classification system that will determine how demanding compliance obligations will be. 

Which products does the CRA cover?

The CRA applies to “products with digital elements”, i.e. any software or hardware product, together with its remote data processing solutions, whose intended purpose or reasonably foreseeable use includes a direct or indirect, logical or physical, data connection to a device or network. The definition is deliberately broad: it