Cyber Resilience Act

CRA scope check

Get a schematic initial assessment in minutes: is your product in scope of the Cyber Resilience Act, which product class is it likely to fall into, and where are your most urgent action areas? The evaluation runs entirely in your browser.

7 questions, the evaluation runs in your browser. Your individual answers only leave the browser when you request the evaluation by e-mail. Our cookieless statistics (Matomo) record only that the check was started, which question numbers were shown and that the evaluation was reached, each with the language, whether it ended early after the question on your role or on the product and, if you request the evaluation by e-mail, its traffic-light level.

Flow of the CRA scope check: seven questions in three stages, the evaluation runs in the browser, individual answers are only transmitted if the results are requested by e-mail. Stage 1 scope: role as manufacturer, importer or distributor, and whether the product contains software or a data connection. Stage 2 classification: what the product is mainly used for, with the possible classifications default, important Class I, important Class II, critical or open under Annexes III and IV. Stage 3 urgency: share of third-party and open-source code, what already exists (SBOM, vulnerability process, updates, security by design), company size and the next market launch or major update. Exits after stage 1: if none of the three roles applies, the manufacturer obligations do not, in principle, apply directly; own obligations may still exist, e.g. as authorised representative (Art. 18) or open-source software steward (Art. 24), and indirect exposure via the supply chain is possible. Without software and without a data connection, the product is schematically outside the CRA (Art. 2(1)). Result: a schematic initial assessment with the typical classification, urgency as a traffic light, the three biggest action areas and the deadlines (reporting since 11 Sep 2026, full requirements from 11 Dec 2027). Footer: general, schematic classification, not legal advice on an individual case. — How the check works: scope, classification, urgency, then your schematic initial assessment.

Note: this check is aimed exclusively at entrepreneurs / businesses (§ 14 German Civil Code). It provides a general, schematic initial assessment based on your input and does not constitute individual legal advice (§ 2 German Legal Services Act).