Cyber Resilience Act scope

The Cyber Resilience Act applies to products with digital elements whose use includes a data connection

Direct answer. Article 2(1) of Regulation (EU) 2024/2847 states: “This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.” Article 2(2) to (8) then state what the Regulation does not apply to, what may be limited or excluded by a delegated act, and what information need not be supplied. Quotes of the articles are the consolidated English text 02024R2847 — EN — 20.11.2024 — 000.003. A consolidation is a documentation tool and has no legal effect. Article 2 and Article 3(1) and (2) carry no amendment marker in that file. Recital 12 is quoted from the English Official Journal of the base act, because the consolidated articles file does not contain the preamble. This page is not legal advice.

CRALedger Duty Records (Shopify App Store · Write a review): “Track CRA product duties, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records.”

Related: EUDR Records Manager — DDS reference numbers on supplier lots.

Free check first: CRA role and scope self-check runs in your browser and sends nothing.

Checklist

Which text this page quotes

Article 2 and Article 3 are the consolidated English text of 20 November 2024 (02024R2847 — EN — 20.11.2024 — 000.003). The file says it is meant purely as a documentation tool and has no legal effect, and that the authentic texts are those in the Official Journal. Its “Corrected by” list names three corrigenda: OJ L 90780, 5.12.2024 (title); OJ L 90555, 2.7.2025 (Article 64(10)); and OJ L 90828, 17.10.2025 (Article 67). None of those markers sits on Article 2 or on Article 3(1) or (2). Later corrigendum CELEX numbers exist. The English ones read for this page correct the title, Article 64(10), and Article 67. A French text of 3 October 2025 corrects Annex I, Part I, point (2)(c), in the French version. This page did not find an English corrigendum that changes Article 2, Article 3(1) or (2), or recital 12.

Recital 12 is the English Official Journal of Regulation (EU) 2024/2847, not the consolidation. The consolidated file used here does not include recitals.

Article 2, as written

Article 2(1): “This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.”

Article 2(2): “This Regulation does not apply to products with digital elements to which the following Union legal acts apply: (a) Regulation (EU) 2017/745; (b) Regulation (EU) 2017/746; (c) Regulation (EU) 2019/2144.”

Article 2(3): “This Regulation does not apply to products with digital elements that have been certified in accordance with Regulation (EU) 2018/1139.”

Article 2(4): “This Regulation does not apply to equipment that falls within the scope of Directive 2014/90/EU of the European Parliament and of the Council.” In the consolidation a footnote marker follows “Council”. The marker number in that file is (1).

Article 2(5): “The application of this Regulation to products with digital elements covered by other Union rules laying down requirements that address all or some of the risks covered by the essential cybersecurity requirements set out in Annex I may be limited or excluded where: (a) such limitation or exclusion is consistent with the overall regulatory framework that applies to those products; and (b) the sectoral rules achieve the same or a higher level of protection as that provided for by this Regulation. The Commission is empowered to adopt delegated acts in accordance with Article 61 to supplement this Regulation by specifying whether such limitation or exclusion is necessary, the products and rules concerned, as well as the scope of the limitation, if relevant.”

Article 2(6): “This Regulation does not apply to spare parts that are made available on the market to replace identical components in products with digital elements and that are manufactured according to the same specifications as the components that they are intended to replace.”

Article 2(7): “This Regulation does not apply to products with digital elements developed or modified exclusively for national security or defence purposes or to products specifically designed to process classified information.”

Article 2(8): “The obligations laid down in this Regulation shall not entail the supply of information the disclosure of which would be contrary to the essential interests of Member States’ national security, public security or defence.”

Two definitions used in that article

Article 3(1): “‘product with digital elements’ means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately;”

Article 3(2): “‘remote data processing’ means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions;”

Recital 12: websites, cloud services, and SaaS

The recital that discusses websites, cloud services, and Software as a Service is recital 12 of the English Official Journal. It reads:

“Cloud solutions constitute remote data processing solutions within the meaning of this Regulation only if they meet the definition laid down in this Regulation. For example, cloud enabled functionalities provided by a manufacturer of smart home devices that enable users to control the device at a distance fall within the scope of this Regulation. On the other hand, websites that do not support the functionality of a product with digital elements, or cloud services designed and developed outside the responsibility of a manufacturer of a product with digital elements do not fall within the scope of this Regulation. Directive (EU) 2022/2555 applies to cloud computing services and cloud service models, such as Software as a Service (SaaS), Platform as a Service (PaaS) or Infrastructure as a Service (IaaS). Entities providing cloud computing services in the Union which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, fall within the scope of that Directive.”

The comparison with Directive (EU) 2022/2555 is CRA vs NIS2.

Covered, not covered, or check further

The middle column repeats the verb from the quoted sentence. “Covered” is used only where the sentence says the Regulation applies or that something falls within scope. “Not covered” is used only where the sentence says it does not apply or does not fall within scope. “Check further” is used where the sentence says application may be limited or excluded, or where the sentence is about information rather than about a product being outside the Regulation.

Article 2 and recital 12, consolidated articles of 20 November 2024 and the English Official Journal recital
Reading Words in the text Sentence
Covered “This Regulation applies” “This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.”
Not covered “does not apply” “This Regulation does not apply to products with digital elements to which the following Union legal acts apply: (a) Regulation (EU) 2017/745; (b) Regulation (EU) 2017/746; (c) Regulation (EU) 2019/2144.”
Not covered “does not apply” “This Regulation does not apply to products with digital elements that have been certified in accordance with Regulation (EU) 2018/1139.”
Not covered “does not apply” “This Regulation does not apply to equipment that falls within the scope of Directive 2014/90/EU of the European Parliament and of the Council.”
Check further “may be limited or excluded” “The application of this Regulation to products with digital elements covered by other Union rules laying down requirements that address all or some of the risks covered by the essential cybersecurity requirements set out in Annex I may be limited or excluded where: (a) such limitation or exclusion is consistent with the overall regulatory framework that applies to those products; and (b) the sectoral rules achieve the same or a higher level of protection as that provided for by this Regulation. The Commission is empowered to adopt delegated acts in accordance with Article 61 to supplement this Regulation by specifying whether such limitation or exclusion is necessary, the products and rules concerned, as well as the scope of the limitation, if relevant.”
Not covered “does not apply” “This Regulation does not apply to spare parts that are made available on the market to replace identical components in products with digital elements and that are manufactured according to the same specifications as the components that they are intended to replace.”
Not covered “does not apply” “This Regulation does not apply to products with digital elements developed or modified exclusively for national security or defence purposes or to products specifically designed to process classified information.”
Check further “shall not entail the supply of information” “The obligations laid down in this Regulation shall not entail the supply of information the disclosure of which would be contrary to the essential interests of Member States’ national security, public security or defence.”
Covered “fall within the scope of this Regulation” “cloud enabled functionalities provided by a manufacturer of smart home devices that enable users to control the device at a distance fall within the scope of this Regulation.”
Not covered “do not fall within the scope of this Regulation” “websites that do not support the functionality of a product with digital elements, or cloud services designed and developed outside the responsibility of a manufacturer of a product with digital elements do not fall within the scope of this Regulation.”
Check further “Directive (EU) 2022/2555 applies” “Directive (EU) 2022/2555 applies to cloud computing services and cloud service models, such as Software as a Service (SaaS), Platform as a Service (PaaS) or Infrastructure as a Service (IaaS).”

Open source, dates, and other CRA pages

Free and open-source software is a separate question from Article 2’s product list. Read Cyber Resilience Act and open source. Application dates are Article 71 on the timeline guide. Manufacturer duties are Articles 13 and 14. Important and critical products are Annex III and Annex IV. Records are CRA duty records. The product-property requirements are Annex I Part I.

A Shopify store that resells a connected device or software

This is a practical note, not a sentence of the Regulation. A merchant who resells a connected device or software still has to ask which operator the Regulation is speaking to. Role and forwarding questions are on vulnerability forwarding for importers and distributors. This page does not claim that a Shopify app, a theme, or a storefront is in or out of scope.

What this page is not

Related pages

Not legal advice. Confirm Article 2, Article 3, and recital 12 on EUR-Lex before you treat a product as in or out of scope. Article quotes are the consolidated English text of 20 November 2024. Recital 12 is the English Official Journal. The app tracks CRA product duties, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records.