Am I Affected by the CRA?

Margaret Ellis

Welcome back to Come Reflect Act by Tributech. I'm Margaret Ellis, and as always, I'm joined by David Evans. Now, we’ve spent quite a bit of time in previous episodes breaking down what the Cyber Resilience Act, or CRA, is all about—its requirements, risk assessments, all that good stuff. But you know, one question keeps cropping up, from both big organizations and smaller companies: "How do I know if I am actually affected?"

David Evans

Yeah, that’s probably the question we hear most these days, Margaret. And look, I get it—if you’re in tech or manufacturing, or even if you just tinker with some IoT devices, it feels like every few months there’s a new thing you’ve gotta worry about. And with the CRA being so broad, it’s not always clear cut, is it?

Margaret Ellis

Exactly. The scope sounds intimidating on paper—and there’s a reason for that, as we will explain. But before we get into exclusions and exceptions, let’s clarify just how wide the net is that the CRA casts, because odds are, if you’re even asking the question, the answer’s probably yes. But let’s not jump ahead. David, want to help set the scene for what the regulation means by ‘products with digital elements’?

David Evans

Sure thing. So, the CRA is really targeting what they call "products with digital elements." That’s this catch-all term for basically anything—hardware or software, doesn’t matter—which can either directly or indirectly connect to another device or a network. And I mean, it’s surprisingly generous in its definition. Even a device that isn’t internet-connected on its own, but sends info through a hub, is caught by the regulation. So we’re talking personal computers, servers, networking equipment, smart home gadgets—basically the lot. Even things like software applications, whether they’re running on your phone, in the cloud, or sitting on some industrial controller.

Margaret Ellis

I think it’s worth zooming in for a sec on this ‘indirect connection’ bit. Sometimes people assume, "Oh, my device never goes online, so I’m fine." But if your product even just passes data through, say, a connected gateway, or it’s designed to interact with a network eventually, it’s still in scope. Doesn’t matter if it’s firmware, an app, or physical kit. I might be oversimplifying, but if there’s a plausible path for data exchange—direct or indirect—the CRA very likely applies.

David Evans

That’s right. And remember, it even scoops up components if they’re being sold separately, like a software library or a smart sensor meant for other products—so long as they’ve got digital elements and are marketed on their own. The point is, the law’s deliberately wide. It wants to make sure the entire digital supply chain is covered.

Margaret Ellis

And that’s a crucial mindset shift. The regulation is horizontal—touches every sector, unless you’re, you know, specifically carved out by another regime. The bottom line is, if your product can talk to anything else digitally—even through a relay or as part of a system—assume it falls within this act. Unless, as we’ll talk about in a bit, it sits in one of the strictly defined exemptions.

Margaret Ellis

So, with the scope in mind, let’s talk about who actually has to do what. The CRA calls out several key roles—manufacturers, importers, and distributors. First off, if you’re developing or manufacturing a product with digital elements, or commissioning someone else to do it for you under your own brand, congratulations: you’re a manufacturer in the eyes of the law!

David Evans

And, uh, if you’re an importer? Say you’re in the EU and you’re bringing in products from outside—maybe from the US or Asia—you’ve got a duty to check those things meet CRA requirements before you put 'em on the market. It doesn’t matter if you’re a giant wholesaler or honestly even a startup just dipping your toes in; the obligations stick. Distributors, you’re not off the hook either. If you’re reselling or providing these digital products, you have to be sure they’ve got the CE mark and aren’t obviously non-compliant.

Margaret Ellis

Everyone in the supply chain is on the hook, bar the consumer at the very end. And, side note, there’s talk of more guidance and easier documentation for the smaller players, but don’t bank on light-touch obligations just because you’re a startup.

Margaret Ellis

So, to recap in a nutshell: If your products—or the ones you import, distribute, or support—end up on the EU market, no matter where you’re actually based, you’re looking at obligations around cybersecurity, reporting vulnerabilities, and, yes, documentation. It’s truly global in effect.

Margaret Ellis

But let’s be fair—a handful of sectors are excluded. If you’re in medical devices, regulated under the EU Medical Devices Regulation or In Vitro Diagnostic Regs, you don’t need to worry about CRA on top. Same goes for automotive—covered under the vehicle type-approval regulation. Aviation gear that’s certified under the EU aviation safety law; that’s out. Marine equipment, and anything strictly for national security or defense purposes, they’re all exempt. Those domains already have their own, often stricter, cybersecurity frameworks.

David Evans

And if you’ve got, I don’t know, a purely mechanical tool—no digital elements, nothing that could connect—it’s outside the CRA by definition. That’s more of a clarification than an actual exemption, but people mix this up sometimes.

Margaret Ellis

Open source is another question we get a lot. Free and open-source software, isn’t in scope if you’re just sharing code as an individual or even a group, and you’re not selling or commercially distributing it. But, and this is key, if a company picks up that open source code, packages it, and offers it commercially under its brand—even if it’s free to use—that might be considered a product with digital elements for CRA. Article 24 even covers so-called ‘open-source stewards’: organizations that maintain or distribute open source commercially have to follow some cybersecurity policies and incident reporting, though not full manufacturer obligations.

David Evans

Let's touch on timelines because that's where people either panic or procrastinate. The CRA is already in force technically, but most of its real teeth show up after a transition period. By September 2026, manufacturers need systems in place to report vulnerabilities—Article 14 stuff. By December 2027, any new product entering the EU market has to fully conform: cybersecurity by design, documentation, the whole nine yards. If your product is already on the market before 11 December 2027, it doesn’t have to suddenly become compliant—unless, and this is sneaky, you make a substantial change to it after that date or if it comes to vulnerability reporting.

Margaret Ellis

Absolutely. And, just to underline—by September 2026, the vulnerability reporting duties apply to all products, existing and new, so there’s really no room to just "wait it out." If you’re already in the market, start aligning your processes now. Prepare for security by design, keep your documentation sharp, and get those incident response systems in line. The aim, really, is that by the end of 2027, everything new on the market is resilient by default and design. There’s a few years, but it’ll go fast—so best to get started sooner rather than later.

David Evans

There’s plenty more detail in Tributech's CRA Knowledge Hub and in what we’ll cover in future episodes, but that's the essential introduction for "Am I affected" Odds are, unless you really fit one of those rare carve-outs, yeah, you are. That’s not meant to scare anyone—it’s just reality! Margaret, always a pleasure dissecting the fine print with you.

Margaret Ellis

Likewise, David. And thanks to everyone for listening—don't forget to subscribe for more compliance insights. Until next time, goodbye!

David Evans

See you next episode, everyone. Take care.