---
title: "Decide whether the Cyber Resilience Act · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-scope
updated: 2026-10-20
licence: "All rights reserved"
---

# Decide whether the Cyber Resilience Act covers your product

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws)
- Rule: List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.
- How: The CRA, Regulation (EU) 2024/2847, covers hardware and software that is sold or supplied in the course of business. Examples are mobile and desktop apps, firmware, devices and paid software libraries. A pure hosted service is outside it, unless it is the remote data processing a product needs to work. Free open-source software outside any business is excluded. Annexes III and IV list important and critical products, such as password managers, VPNs and operating systems. Those need stricter conformity assessment.
- Check: The obligations register lists every shipped product with a CRA decision and, when it applies, its class. A product released by the build pipeline but missing from the list fails the build.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-scope`.

- Previous: [Map the NIS2 measures to controls](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-measures)
- Next: [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting)
- [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws)