Agent WranglersProduct and sector laws Required
Decide whether the Cyber Resilience Act covers your product
List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.
How to do it
The CRA, Regulation (EU) 2024/2847, covers hardware and software that is sold or supplied in the course of business. Examples are mobile and desktop apps, firmware, devices and paid software libraries. A pure hosted service is outside it, unless it is the remote data processing a product needs to work. Free open-source software outside any business is excluded. Annexes III and IV list important and critical products, such as password managers, VPNs and operating systems. Those need stricter conformity assessment.
How to check
The obligations register lists every shipped product with a CRA decision and, when it applies, its class. A product released by the build pipeline but missing from the list fails the build.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-scope.