--- title: "Decide whether the Cyber Resilience Act ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/security-laws/cra-scope id: CMP-48 level: Recommended applies: digital-product region: EU updated: 2026-10-27 build: a2a6bdfed830 tokens: 911 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Decide whether the Cyber Resilience Act covers your product For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-48 - Level: Recommended - Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md) - Rule: List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class. - Check: The obligations register lists every shipped product with a CRA decision and, when it applies, its class. A product released by the build pipeline but missing from the list fails the build. - Applies when: The project sells or hands out software or devices that others run, not only a hosted service. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: The CRA, Regulation (EU) 2024/2847, covers hardware and software that is sold or supplied in the course of business. Examples are mobile and desktop apps, firmware, devices and paid software libraries. A pure hosted service is outside it, unless it is the remote data processing a product needs to work. Free open-source software outside any business is excluded. Annexes III and IV list important and critical products, such as password managers, VPNs and operating systems. Those need stricter conformity assessment. For each product it covers, follow [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md). ## Sources - [Cyber Resilience Act, Regulation (EU) 2024/2847](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) ## Related rules - CMP-49 [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) in Compliance and governance - DOC-39 [Ship the user information the Cyber Resilience Act lists](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/cra-user-information.md) in Documentation - IOT-35 [Publish the support end date for every model](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/support-end-date.md) in Connected devices - OSS-27 [Find out your role under the Cyber Resilience Act](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/cra-role.md) in Open source maintenance - TDD-13 [Record the product's Cyber Resilience Act duties](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check.md) in Technical due diligence **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Give financial customers the facts for their DORA register](https://agentwranglers.se/playbook/compliance/security-laws/dora-register-facts.md) - Next: [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) - [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)