Get in Touch

Edit Template
Cyber Resilience Act (CRA) Consulting for Manufacturers

Get in Touch

Edit Template
Cyber Resilience Act

CRA Scope and Product Classification

We review whether and how the Cyber Resilience Act applies to a product. The assessment considers product boundaries, market placement, intended use and relevant category definitions. We document the reasoning and identify information that needs further review, producing a reasoned scope and classification record.

Illustrative workflow Product Market Scope Decision
Product
Record the product and its interfaces.
Market
Clarify supply, intended use and economic-operator role.
Scope
Review inclusion, exclusions and category definitions.
Decision
Document the conclusion and what remains uncertain.

Scope

  • Product boundary and applicability review

  • Category and conformity-route analysis

  • Initial engineering gap identification

Starting information

Product description, interfaces, intended use, commercial role and target markets.

Applicable framework

The reference is Regulation (EU) 2024/2847. For radio products, RED and EN 18031 requirements are reviewed separately. EN 40000 drafts may inform planning but are not treated as proof of conformity.

Radio equipment

For radio equipment, we review the applicable RED cybersecurity requirements and the relevant parts of EN 18031. We support requirements mapping, security design and evidence preparation, taking the Official Journal restrictions into account. Product scope and assessment route are reviewed individually.

CRA

We support CRA scope assessment, implementation planning and technical documentation. Relevant EN 40000 standardization work is tracked by part and status. Drafts can inform preparation; they are not presented as published harmonised standards or proof of conformity.

RED-to-CRA transition

Delegated Regulation (EU) 2026/339 will repeal Delegated Regulation (EU) 2022/30 from 11 December 2027, aligning RED's cybersecurity delegated act with the CRA transition. This does not repeal Directive 2014/53/EU itself, and RED and CRA remain separate legal instruments with their own scope.

Contact

Discuss your product

Tell us about the product, its current stage and the decision you need to make.

Discuss your product

© 2026 Created by  PRAETORIO Technologies

© 2026 Created by  PRAETORIO Technologies