Am I even in scope?

Step one

Start here — both have to be true

If either of these is a no, you can stop reading: none of what follows applies to you, and that is a useful thing to know for certain.

• Your product contains software or firmware, or connects to a network — directly, or indirectly through a companion app, a hub, or a cloud service.
• You place it on the EU market, the UK market, or both — under your own name or trade mark, or as a component another manufacturer integrates into a product that goes there.

Step two

Then work through the three

They overlap rather than replace each other. It is entirely normal to be in scope of all three at once, on the same product, with three different dates.

• EU Cyber Resilience Act

  Regulation (EU) 2024/2847

  Almost certainly yes, if you place a product with digital elements on the EU market.

  Reporting obligations from 11 September 2026 · main obligations from 11 December 2027

  • Does your product contain software or firmware and connect, directly or indirectly, to a device or network? If yes, it is a "product with digital elements" and it is in scope.
  • Could you report an actively exploited vulnerability within 24 hours of becoming aware of it, follow up at 72 hours, and file a final report inside 14 days? This obligation lands first, and it binds products you have ALREADY placed on the market — not only the next one.
  • Is your product in an important or critical class (Annex III/IV) — password managers, network management, boot managers, smart-home products with security functions, and similar? That changes the conformity route you must take, not whether you are in scope.

  Boundaries. Carved out where sector law already covers the same ground: medical devices under MDR/IVDR, motor vehicles under type-approval, and civil aviation. Open-source software supplied outside a commercial activity is also outside it.

• RED cybersecurity requirements

  Delegated Regulation (EU) 2022/30, via RED Article 3(3)(d), (e) and (f)

  Yes, if your product has a radio and touches the internet.

  Mandatory since 1 August 2025 — enforcement is live now

  • 3(3)(d) — network protection. Does the equipment connect to the internet, either directly or through another device? Nearly all connected radio equipment lands here.
  • 3(3)(e) — personal data and privacy. Is it a wearable, a toy, or childcare equipment such as a baby monitor, or does it otherwise process personal or location data?
  • 3(3)(f) — fraud. Does it transfer money or virtual currency?

  Boundaries. Radio equipment covered by MDR/IVDR, and motor vehicles inside the type-approval regime, sit outside this delegated regulation. EN 18031-1/-2/-3 are the harmonised standards, and note their restrictions — meeting the standard does not automatically discharge every part of the requirement.

• UK PSTI regime

  Product Security and Telecommunications Infrastructure Act 2022, and its 2023 Regulations

  Yes, if you sell consumer connectable products in the UK.

  In force since 29 April 2024 — the oldest live obligation of the three

  • Is the product internet- or network-connectable and supplied to UK consumers?
  • Can you show no universal default passwords, a published point of contact for vulnerability reports, and a stated minimum period for security updates?
  • Does a statement of compliance accompany the product?

  Boundaries. It binds manufacturers, importers and distributors, not just the brand on the box. Certain products are excepted — including some vehicles, smart meters and medical devices.

The honest exits

You are probably NOT in scope if

Said plainly, because a scope test that can only ever answer "yes" is a sales funnel wearing a lab coat.

• The product has no software, no firmware and no network connection of any kind.
• You sell only outside the UK and EU, and nobody imports it into either market on your behalf.
• It is a medical device under MDR/IVDR, a type-approved motor vehicle, or civil-aviation equipment — sector law already covers this ground, though it covers it with its own requirements rather than none.
• You publish open-source software outside any commercial activity.

FAQ

The questions this usually raises

• We only make a module or component, not the finished product. +

  You are still likely in scope. The CRA applies to products with digital elements placed on the market, and a component placed on the market is one. In practice the pressure arrives commercially before it arrives legally: the manufacturer integrating your part will ask you for an attestation, an SBOM, or a dated roadmap, because they cannot answer their own obligations without you.

• We are already CE marked. Does that cover it? +

  Not by itself. Existing CE marking covers the directives it was assessed against — EMC, safety, radio spectrum. The RED cybersecurity requirements under Article 3(3)(d), (e) and (f) are a separate assessment that became mandatory on 1 August 2025, and the CRA is a separate regulation again with its own conformity route.

• Nothing has been exploited in our products. Does Article 14 still matter? +

  The reporting duty only triggers on an actively exploited vulnerability or a severe incident, so many manufacturers will have nothing to report for years. The obligation that bites every day is the one underneath it: you cannot report within 24 hours what you cannot detect. That means knowing your components, watching them, and having a path from advisory to named person. That part is engineering, and it is continuous.

• Is this legal advice? +

  No — and where you need a legal opinion you should get one. This is an engineer's reading of published regulation, written to help you work out whether to take the question seriously. Every instrument is named above so you can go and check the primary source yourself, which is the same standard the sample report holds itself to.

Written by a firmware engineer from the published texts, not by a lawyer, and current at the time of writing. It is a starting point for a technical conversation, not a legal opinion or a conformity assessment.

Next

If the answer was yes

The cheapest way to find out where you actually stand is the Readiness Snapshot: £950, no code access, no NDA, no scoping call, delivered within five working days. Or read the sample report first and judge the work before you spend anything.