CRA Scope Checker: does the EU CRA apply?
A source-linked questionnaire that walks product type, market, connectivity, commercial activity, exclusions, role and timing, then reports an indicative scope result, role obligations and transition dates.
Free tool: results are indicative and are not a certification. Use is subject to the Terms of service and the Privacy policy.
Indicative assessment, not legal advice
Each question cites the provision it comes from. The result is a starting point for a review, not a classification decision, a conformity assessment or a legal opinion.
Product scope questionnaire
0 of 9 answered · rule set EH-SCOPE-2026-10-v4Answers stay in this browser tab. Nothing is submitted anywhere.
Limits you should know
- Indicative only — not a legal opinion and not a conformity assessment
- Answers stay in your browser and in the exported JSON you choose to save
- No account, no upload, no submission to a regulator
What this result does not prove
Indicative scope and role assessment with citations. It cannot certify compliance and does not replace legal review.
What is the CRA Scope Checker?
The EU Cyber Resilience Act (Regulation (EU) 2024/2847) places obligations on manufacturers of products with digital elements placed on the EU market. The first practical question is scope: is the product in scope, what role does your organisation have, and which dates apply?
This checker walks the facts that drive that question — product type, market, connectivity, commercial activity, exclusions, role and timing — and returns an indicative result with the provision behind each step. It is a preparation aid, not a legal classification or a conformity assessment.
Supported formats and limits
| Accepted input | Questionnaire answers — no file required |
|---|---|
| Enforced limits | Indicative only — not a legal opinion and not a conformity assessment · Answers stay in your browser and in the exported JSON you choose to save · No account, no upload, no submission to a regulator |
| Processing | Assessment runs entirely in your browser using the published rule set. Answers are not transmitted. |
| Not included | Indicative scope and role assessment with citations. It cannot certify compliance and does not replace legal review. |
How it works
- Answer the scope questions. The questionnaire covers the product, how it is supplied, whether it is connected, and which exclusions may apply.
- Apply the published rules. The local rule set evaluates the answers against the CRA scope and role logic, citing the article used at each step.
- Read the indicative result. The result separates scope, role, likely risk class and the transition dates that apply to your answers.
- Export the assessment. The JSON export records the answers and citations for an internal review. It is not a regulatory filing.
What it checks
- Whether the product is a product with digital elements supplied in the course of a commercial activity
- Whether an exclusion or a sector-specific regime may apply
- Whether the organisation acts as manufacturer, importer, distributor or open-source steward
- Which obligations and reporting dates are relevant to that role
- Which answers are uncertain and should be confirmed with counsel
Common errors and fixes
The answer depends on a product classification I cannot confirm.
Treat the result as a list of questions, not a conclusion. Export it, attach the cited provisions, and have the classification confirmed against the current regulation text and your product documentation.
The checker says my product is out of scope because of an exclusion.
Exclusions are narrow and regime-specific. Check whether another Union act already covers the product, and confirm the boundary with counsel before relying on it.
I am an open-source project, not a company.
The open-source steward role has its own conditions. The checker can indicate the role, but it cannot decide whether your governance model meets the regulatory definition.
The dates shown do not match a blog post I read.
Use the regulation and the Commission's current guidance. The main obligations and the reporting obligations have different application dates, and transition rules depend on when a product was placed on the market.
Example output
The result is a report, not a score. This is the shape of the output you can export; the example reports show the full engine output for a synthetic firmware SBOM.
Scope: indicative result with the provisions that drove it
Role: manufacturer, importer, distributor or open-source steward
Dates: reporting obligations and main obligations, where applicable
Uncertainty: answers that need confirmation
Export: JSON with answers and citationsPrivacy and data handling
Answers are held in React state in this browser tab and are not transmitted. The JSON export is generated locally. Reloading the page discards the assessment unless you saved the export.
Frequently asked questions
Does this tool prove CRA compliance?
No. It gives an indicative scope and role assessment with citations. Compliance depends on the product, the technical documentation, the risk assessment and, for some products, third-party assessment. No tool can declare you compliant.
Is the result legal advice?
No. It is an informational assessment based on the published regulation. Classification decisions and obligations should be confirmed with qualified counsel and the current official text.
Which CRA dates does it use?
The regulation's application dates: reporting obligations from 11 September 2026 and the main obligations from 11 December 2027. Products placed on the market before the main date are affected when substantially modified. Always re-check the current text and guidance.
Are my answers sent anywhere?
No. The assessment runs in the browser and is not submitted to a server, a regulator or an EmbedHarbor account.
Related resources
Where this fits in the product workflow
The free tools answer one question at a time. EmbedHarbor is building the connected workflow around them — product versions, supplier components and release evidence. Product-version storage and monitoring are Early Access, not generally available.