Agent WranglersCMP-48Recommended EU law
Decide whether the Cyber Resilience Act covers your product
List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.
Region
European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
How to do it
The CRA, Regulation (EU) 2024/2847, covers hardware and software that is sold or supplied in the course of business. Examples are mobile and desktop apps, firmware, devices and paid software libraries. A pure hosted service is outside it, unless it is the remote data processing a product needs to work. Free open-source software outside any business is excluded. Annexes III and IV list important and critical products, such as password managers, VPNs and operating systems. Those need stricter conformity assessment. For each product it covers, follow Report exploited vulnerabilities in your products.
How to check
The obligations register lists every shipped product with a CRA decision and, when it applies, its class. A product released by the build pipeline but missing from the list fails the build.
Sources
Related rules
- CMP-49 Report exploited vulnerabilities in your products in Compliance and governance
- DOC-39 Ship the user information the Cyber Resilience Act lists in Documentation
- IOT-35 Publish the support end date for every model in Connected devices
- OSS-27 Find out your role under the Cyber Resilience Act in Open source maintenance
- TDD-13 Record the product's Cyber Resilience Act duties in Technical due diligence
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/security-laws/cra-scope">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.