Cyber Resilience Act: applicability check
About this app
A product runs through the five CRA checks (digital product, operator, EU market, making available, cut-off date) and either drops out or gets its role: manufacturer, importer, distributor or deemed manufacturer. Plus product class with conformity route (module A, B + C, H, certificate) and timeline: reporting since 11 Sep 2026 even for existing units, full application from 11 Dec 2027. Ten examples from mechanical engineering.
With explain mode: an AI tutor walks you through the app, points out what matters in the scene and answers your questions.
When the Cyber Resilience Act applies
Regulation (EU) 2024/2847 covers products with digital elements made available on the EU market in the course of a commercial activity, even free of charge. This includes hardware, software, separately sold components and remote data processing without which a function would be missing. Pure SaaS running only at the provider is not covered. In force since 10 Dec 2024, reporting under Art. 14 since 11 Sep 2026, full application for units placed on the market from 11 Dec 2027.
What the app shows
A product rides a test conveyor through five gates: digital product, operator, EU market, making available, cut-off date. If it fails it drops into a tray; otherwise it gets its role: manufacturer, importer, distributor or deemed manufacturer after a substantial modification. Below are the class pyramid of default, important class I and II and critical, with the conformity route under Art. 32, and a timeline with reporting and all obligations for your unit.
Try it yourself
Pick the machine delivered in 2025: gate 5 shows a clock, the requirements do not apply, but reporting has since 11 Sep 2026. The industrial router is class I; without a harmonised standard the route leads via a notified body. The pure SaaS analysis drops out at gate 1. Change the router’s role to manufacturer and see how obligations and deadlines shift.
Frequently asked questions
- Does the CRA apply to products already delivered?
- Units placed on the market before 11 Dec 2027 generally need not meet the requirements unless they are substantially modified. The reporting obligations under Art. 14 have applied to them as well since 11 Sep 2026.
- Is software as a service covered by the CRA?
- Only if the software runs at the user or belongs to a product as remote data processing without which a function would be missing. Pure SaaS on the provider’s systems is not a product with digital elements.
- When does a product need a notified body?
- Default products are self-assessed (module A). Important class I products only if harmonised standards are fully applied, otherwise module B + C or H. Class II always with a notified body or certificate; critical products need a certificate once it is required.
- What can I try in the app?
- Run ten mechanical engineering examples through the five checks, change every input yourself, read role, class, conformity route and deadlines and see where a product fails.
Subject: Betriebliche Weiterbildung
More from Betriebliche Weiterbildung
A VisuApp by heyprof: interactive, free in your browser, no sign-up. What is a VisuApp? · All apps