{
  "site": "CRARequired",
  "generated_at": "2026-10-10T08:30:40Z",
  "facts_version": "2026.09.4",
  "rules_version": "2026.09.1",
  "pages": [
    {
      "id": "RP-016",
      "url": "https://crarequired.com/products/ai-and-ml-products",
      "question": "Does the CRA apply to AI products?",
      "cluster": "products",
      "summary": "AI does not change the test: an installed AI app, agent or on-device model supplied commercially is a product with digital elements; a pure hosted API with nothing installed is a cloud service outside the Regulation.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-008",
        "F-107",
        "F-006",
        "F-007",
        "F-103",
        "F-104"
      ]
    },
    {
      "id": "RP-004",
      "url": "https://crarequired.com/products/browser-extensions",
      "question": "Does the CRA apply to browser extensions?",
      "cluster": "products",
      "summary": "A browser extension that is sold, subscription-based or ad-monetised and available to EU users is likely in scope; a non-monetised extension is not placed on the market.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-101",
        "F-009",
        "F-107"
      ]
    },
    {
      "id": "RP-015",
      "url": "https://crarequired.com/products/connected-toys",
      "question": "Does the CRA apply to connected toys?",
      "cluster": "products",
      "summary": "A connected toy sold in the EU is connected hardware with embedded software and is in scope of the Cyber Resilience Act in addition to toy safety legislation.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-107",
        "F-006",
        "F-101",
        "F-106"
      ]
    },
    {
      "id": "RP-005",
      "url": "https://crarequired.com/products/desktop-applications",
      "question": "Does the CRA apply to desktop software?",
      "cluster": "products",
      "summary": "Commercially supplied desktop software with any network connection, even for updates or licensing, is a product with digital elements likely in scope of the Cyber Resilience Act.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-101",
        "F-004",
        "F-014",
        "F-105",
        "F-002",
        "F-003"
      ]
    },
    {
      "id": "RP-011",
      "url": "https://crarequired.com/products/developer-tools",
      "question": "Does the CRA apply to developer tools?",
      "cluster": "products",
      "summary": "Commercially supplied developer tools are installed software products in scope of the Cyber Resilience Act; free open-source tooling that is not monetised is not placed on the market.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-009",
        "F-107",
        "F-101",
        "F-102"
      ]
    },
    {
      "id": "RP-007",
      "url": "https://crarequired.com/products/firmware-and-iot-devices",
      "question": "Does the CRA apply to IoT devices?",
      "cluster": "products",
      "summary": "A connected hardware product sold in the EU is squarely a product with digital elements; sector-specific exclusions such as medical devices and type-approved vehicles are the main exceptions.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-010",
        "F-007",
        "F-107",
        "F-006",
        "F-101",
        "F-003"
      ]
    },
    {
      "id": "RP-009",
      "url": "https://crarequired.com/products/games",
      "question": "Does the CRA apply to video games?",
      "cluster": "products",
      "summary": "A game sold or monetised in the EU is installed software with a network connection and is likely in scope; a free game with no monetisation is not placed on the market.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-107",
        "F-006",
        "F-009",
        "F-101"
      ]
    },
    {
      "id": "RP-014",
      "url": "https://crarequired.com/products/industrial-and-embedded-software",
      "question": "Does the CRA apply to embedded software?",
      "cluster": "products",
      "summary": "Embedded and industrial software supplied commercially in the EU is a product with digital elements, whether shipped inside hardware or licensed separately; sectoral exclusions and legacy timing are the main qualifiers.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-104",
        "F-007",
        "F-010",
        "F-004",
        "F-014",
        "F-101"
      ]
    },
    {
      "id": "RP-001",
      "url": "https://crarequired.com/products/mobile-apps",
      "question": "Does the CRA apply to mobile apps?",
      "cluster": "products",
      "summary": "A commercial mobile app available in the EU is a software product with digital elements and is likely in scope; a free, non-monetised hobby app is not placed on the market.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-101",
        "F-009",
        "F-107",
        "F-006",
        "F-002",
        "F-003",
        "F-004"
      ]
    },
    {
      "id": "RP-013",
      "url": "https://crarequired.com/products/password-managers-and-security-software",
      "question": "Does the CRA apply to password managers?",
      "cluster": "products",
      "summary": "Security software sold or subscribed to in the EU is installed software with a network connection and is in scope; its class and conformity route are a matter for the full determination on CEMarque.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-107",
        "F-006",
        "F-009",
        "F-101"
      ]
    },
    {
      "id": "RP-012",
      "url": "https://crarequired.com/products/routers-and-network-equipment",
      "question": "Does the CRA apply to routers?",
      "cluster": "products",
      "summary": "Network equipment sold in the EU is connected hardware with embedded software and is in scope of the Cyber Resilience Act; the full checker on CEMarque determines its class.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-101",
        "F-106",
        "F-010",
        "F-003"
      ]
    },
    {
      "id": "RP-002",
      "url": "https://crarequired.com/products/saas-and-web-apps",
      "question": "Does the CRA apply to SaaS?",
      "cluster": "products",
      "summary": "A pure cloud service is outside the Cyber Resilience Act and may fall under NIS2 instead; a backend that an installed product cannot function without is part of that product and in scope with it.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-008",
        "F-006",
        "F-107",
        "F-005",
        "F-103",
        "F-007",
        "F-101"
      ]
    },
    {
      "id": "RP-006",
      "url": "https://crarequired.com/products/sdks-and-libraries",
      "question": "Does the CRA apply to SDKs and libraries?",
      "cluster": "products",
      "summary": "A commercially supplied SDK or library is itself a product with digital elements; free open-source libraries that are not monetised are not placed on the market.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-104",
        "F-009",
        "F-007",
        "F-102",
        "F-101"
      ]
    },
    {
      "id": "RP-008",
      "url": "https://crarequired.com/products/smart-home-devices",
      "question": "Does the CRA apply to smart home devices?",
      "cluster": "products",
      "summary": "Consumer smart home devices sold in the EU are connected hardware products with digital elements and are in scope; the companion cloud service is part of the product when the device cannot work without it.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-107",
        "F-006",
        "F-010",
        "F-106",
        "F-101"
      ]
    },
    {
      "id": "RP-010",
      "url": "https://crarequired.com/products/wearables",
      "question": "Does the CRA apply to wearables?",
      "cluster": "products",
      "summary": "A consumer wearable sold in the EU is connected hardware in scope of the Cyber Resilience Act; a wearable regulated as a medical device is excluded and follows the medical devices regulation.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-010",
        "F-107",
        "F-006",
        "F-101"
      ]
    },
    {
      "id": "RP-003",
      "url": "https://crarequired.com/products/wordpress-plugins",
      "question": "Does the CRA apply to WordPress plugins?",
      "cluster": "products",
      "summary": "A paid or freemium WordPress plugin supplied to EU customers is a software product in scope; a free open-source plugin that is not monetised is not placed on the market.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-005",
        "F-007",
        "F-009",
        "F-101",
        "F-102",
        "F-104"
      ]
    },
    {
      "id": "RP-105",
      "url": "https://crarequired.com/situations/browser-only-web-application",
      "question": "Is a browser-only web app in scope of the CRA?",
      "cluster": "situations",
      "summary": "A web application used only through a browser, with nothing installed and no device, is not a product with digital elements; it is a cloud service that may fall under NIS2 instead.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-008",
        "F-005",
        "F-103",
        "F-006",
        "F-107",
        "F-102"
      ]
    },
    {
      "id": "RP-101",
      "url": "https://crarequired.com/situations/free-app-with-in-app-purchases",
      "question": "Does the CRA apply to a free app with in-app purchases?",
      "cluster": "situations",
      "summary": "Free to download is not the same as non-commercial: an app monetised through purchases, subscriptions or advertising is made available in the course of a commercial activity and is in scope.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-007",
        "F-005",
        "F-101",
        "F-102",
        "F-009"
      ]
    },
    {
      "id": "RP-108",
      "url": "https://crarequired.com/situations/internal-tools-never-sold",
      "question": "Does the CRA apply to internal tools?",
      "cluster": "situations",
      "summary": "Software used only within your own organisation and never supplied to a third party is not made available on the market and is outside the Cyber Resilience Act; supplying it to customers or partners changes that.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-101",
        "F-007",
        "F-005",
        "F-102"
      ]
    },
    {
      "id": "RP-107",
      "url": "https://crarequired.com/situations/non-eu-company-selling-into-the-eu",
      "question": "Does the CRA apply to a non-EU company selling into the EU?",
      "cluster": "situations",
      "summary": "A non-EU manufacturer whose product with digital elements is made available on the EU market is in scope as a manufacturer; establishment outside the EU changes who represents it, not whether the Regulation applies.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-101",
        "F-034",
        "F-005",
        "F-011",
        "F-012",
        "F-007"
      ]
    },
    {
      "id": "RP-102",
      "url": "https://crarequired.com/situations/open-source-software",
      "question": "Does the CRA apply to open-source software?",
      "cluster": "situations",
      "summary": "Free and open-source software that is not monetised is not considered placed on the market; organisations that systematically support it may be open-source software stewards under a lighter regime; commercialising it brings full scope.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-009",
        "F-102",
        "F-007",
        "F-005",
        "F-104"
      ]
    },
    {
      "id": "RP-104",
      "url": "https://crarequired.com/situations/product-that-depends-on-your-backend",
      "question": "Does the CRA cover my product's backend?",
      "cluster": "situations",
      "summary": "A backend designed and developed by the manufacturer that the product cannot function without is remote data processing and part of the product; a third-party service you merely call is not.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-006",
        "F-107",
        "F-005",
        "F-008",
        "F-103"
      ]
    },
    {
      "id": "RP-103",
      "url": "https://crarequired.com/situations/selling-a-white-label-product",
      "question": "Does the CRA apply to white-label products sold under my brand?",
      "cluster": "situations",
      "summary": "Marketing a product with digital elements under your own name or trademark makes you the manufacturer for the Cyber Resilience Act, whoever developed or built it.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-106",
        "F-011",
        "F-005",
        "F-007",
        "F-104",
        "F-101",
        "F-012",
        "F-013"
      ]
    },
    {
      "id": "RP-106",
      "url": "https://crarequired.com/situations/selling-outside-the-eu-only",
      "question": "Does the CRA apply if I only sell outside the EU?",
      "cluster": "situations",
      "summary": "The Cyber Resilience Act applies to products made available on the EU market; a product supplied only outside the EU is not in scope, wherever the manufacturer is established.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-101",
        "F-005",
        "F-007",
        "F-034"
      ]
    },
    {
      "id": "RP-203",
      "url": "https://crarequired.com/roles/distributor-under-the-cra",
      "question": "Who is a distributor under the CRA?",
      "cluster": "roles",
      "summary": "A distributor makes a product available on the EU market without being its manufacturer or importer; the product is in scope and the distributor must act with due care, checking marking and declaration rather than assessing conformity.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-013",
        "F-011",
        "F-106",
        "F-005",
        "F-012",
        "F-003",
        "F-014"
      ]
    },
    {
      "id": "RP-202",
      "url": "https://crarequired.com/roles/importer-under-the-cra",
      "question": "Who is an importer under the CRA?",
      "cluster": "roles",
      "summary": "An importer is the EU business that places a product from a non-EU manufacturer on the EU market; the product is in scope and the importer must verify the manufacturer's conformity work rather than redo it.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-012",
        "F-011",
        "F-106",
        "F-005",
        "F-034",
        "F-003"
      ]
    },
    {
      "id": "RP-201",
      "url": "https://crarequired.com/roles/manufacturer-under-the-cra",
      "question": "Who is a manufacturer under the CRA?",
      "cluster": "roles",
      "summary": "You are a manufacturer if you develop or manufacture a product with digital elements, or have it developed, and market it under your own name or trademark; that is the role the full CEMarque check builds on.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-011",
        "F-106",
        "F-104",
        "F-005",
        "F-007",
        "F-002"
      ]
    },
    {
      "id": "RP-204",
      "url": "https://crarequired.com/roles/open-source-software-steward",
      "question": "Who is an open-source software steward under the CRA?",
      "cluster": "roles",
      "summary": "An open-source software steward is a legal person, other than a manufacturer, that systematically supports the development of free and open-source software intended for commercial activities; a lighter regime applies instead of manufacturer obligations.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-009",
        "F-102",
        "F-007",
        "F-011"
      ]
    },
    {
      "id": "RP-302",
      "url": "https://crarequired.com/exclusions/medical-devices-and-other-exclusions",
      "question": "Which products are excluded from the CRA?",
      "cluster": "exclusions",
      "summary": "Products already regulated as medical devices, in vitro diagnostics, type-approved motor-vehicle products, and certain aviation, marine, defence, national-security and spare-part cases are excluded from the Cyber Resilience Act.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-010",
        "F-005",
        "F-007"
      ]
    },
    {
      "id": "RP-401",
      "url": "https://crarequired.com/exclusions/spare-parts-and-replacement-components",
      "question": "Does the CRA apply to spare parts?",
      "cluster": "exclusions",
      "summary": "Spare parts supplied only to replace identical components in a product with digital elements are excluded from the Cyber Resilience Act; a replacement part with different or added functions is a product in its own right.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-010",
        "F-005",
        "F-007",
        "F-014"
      ]
    },
    {
      "id": "RP-303",
      "url": "https://crarequired.com/dates/key-dates",
      "question": "When does the CRA apply?",
      "cluster": "dates",
      "summary": "The Regulation entered into force on 10 December 2024; manufacturer reporting obligations apply from 11 September 2026; it applies in full from 11 December 2027, with legacy products caught only on substantial modification.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-001",
        "F-002",
        "F-003",
        "F-004",
        "F-014",
        "F-005",
        "F-030"
      ]
    },
    {
      "id": "RP-301",
      "url": "https://crarequired.com/dates/products-already-on-the-market",
      "question": "Does the CRA apply to products already on the market?",
      "cluster": "dates",
      "summary": "Products placed on the market before 11 December 2027 are subject to the full requirements only if substantially modified after that date; Article 14 reporting obligations apply to them anyway.",
      "last_verified": "2026-09-25",
      "fact_ids": [
        "F-004",
        "F-014",
        "F-105",
        "F-002",
        "F-003",
        "F-005"
      ]
    }
  ]
}