CRA · Reg. (EU) 2024/2847 · Cyber Resilience Act

Applicability Assessment
Cyber Resilience Act

Complete this self-assessment questionnaire to obtain a preliminary diagnosis on whether Regulation (EU) 2024/2847 applies to your product and what compliance gaps are detected. Estimated time: 5-7 minutes.

Scope and Exclusions
Applicability of the regulation to your product
Classification
Operator type and product category
Current Capabilities
Compliance gaps detected
Preliminary Diagnosis
Result and recommendations by email

CRA (EU) 2024/2847 Applicability Self-Assessment Questionnaire

This questionnaire will give you a preliminary assessment of whether Regulation (EU) 2024/2847 (Cyber Resilience Act) applies to your product and, if so, which compliance gaps are identified.

Estimated time: 5-7 minutes. Once submitted, our team will validate your details and send you the results dashboard by email.

Does your organization manufacture, develop or import a product that includes digital components (software, firmware, hardware with connectivity or data processing capability)?

Examples: apps, IoT, routers, cameras, business software, embedded systems, medical devices with connectivity. Purely analog products without software are out of scope. (Art. 2.1, 3.1)

Does the product connect, directly or indirectly, to a network (internet, Bluetooth, Zigbee, USB, etc.) or to another device?

Even an occasional USB or Bluetooth connection counts. Only completely isolated products with no communication interface of any kind are out of scope. (Art. 2.1, 3.1)

Is the product placed, or is it planned to be placed, on the European Union market?

The CRA applies to any product on the European market, regardless of where it is manufactured or where the manufacturer is based. (Art. 2.1)

Is the product intended EXCLUSIVELY for military, national defense or national security applications?

Explicit exclusion under Art. 2.7. If the answer is Yes, the CRA does NOT apply. If the product also has civilian use, the CRA may apply to that variant.

Is the product EXCLUSIVELY open-source software published on a non-commercial basis (with no paid support, SaaS or associated commercial services)?

The exemption applies only if there is NO commercial support, paid services or associated SaaS. Any monetization model triggers the CRA. (Rec. 18, Art. 2.6)

Does your product belong to any of these categories regulated by sector-specific legislation?

Medical devices for human use and accessories (Reg. 2017/745), in vitro diagnostic medical devices (Reg. 2017/746), vehicles of categories M, N, O and their systems (Reg. 2019/2144), products certified under Reg. 2018/1139 (civil aviation), spare parts. (Art. 2.2 to 2.4)

In what capacity does your company place the product on the European market?

Manufacturers, importers and distributors have different obligations. (Art. 13, 19, 20)

Does your product belong to any of the categories in Annex III of the CRA (Important Products Class I or II)?

Annex III includes, among others: identity management and privileged access management, browsers, password managers, antivirus, VPNs, network managers, SIEM, boot managers, PKI, operating systems, routers/modems/switches, microprocessors and microcontrollers with security functions, ASIC/FPGA with security functions, smart home virtual assistants, home security products (cameras, locks, alarms), connected toys with social interaction features, medical wearables not covered by Reg. 2017/745. Class II adds: hypervisors, firewalls, IDS/IPS, tamper-resistant microprocessors and microcontrollers.

Does your product belong to Annex IV of the CRA (Critical Products)?

Annex IV includes: computing devices with security boxes, smart meter gateways and devices with advanced security (including cryptographic processing), smart cards and similar elements (secure elements). These products require mandatory assessment by an external notified body, without exception.

Does your company currently have the capacity to publish security updates for the product for at least 5 years from its placement on the market?

5 years is the indicative minimum for most products. Being unable to maintain this support is a critical compliance gap. (Art. 13.8)

Do you have a documented process to identify, prioritize and report vulnerabilities (including notification to ENISA/CSIRT within 24 hours if they are actively exploited)?

Art. 14 requires mandatory notification within 24 hours. This requirement applies early, from 11 September 2026.

Do you have technical documentation that includes a cybersecurity risk assessment, product architecture, SBOM and vulnerability management process?

Annex VII requires complete technical documentation. The absence of any of these elements constitutes non-compliance from 11 December 2027.

Have you drawn up, or do you plan to draw up, an EU Declaration of Conformity (EU DoC) and affix the CE marking to the product?

The CE marking is mandatory for all products under the CRA. The DoC must be kept for 10 years after the product is placed on the market. (Art. 28, Annex V)

On what date do you plan to start the CRA compliance work?

Depending on the requirements that apply, you have more or less time to start implementation. We recommend planning against 11 December 2027 (general application).

To send you the assessment result, we need some corporate contact details. After verification, we will email you a link to the diagnostic dashboard.

Please use your corporate email. Do not use free email providers (Gmail, Outlook, Yahoo...).
Your data will be processed by Internet Security Auditors solely to send you the assessment result and, where applicable, to contact you for commercial purposes. You can exercise your rights at any time.
Please complete all required fields (*) and accept the privacy policy.
✅
Assessment submitted successfully
Our team will review your answers and send you by email the dashboard with the preliminary assessment of whether the CRA (EU) 2024/2847 applies to your product.

If you have any questions in the meantime, please contact us at info@isecauditors.com.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88