Am I Affected by the CRA? A Self-Check for Manufacturers

Written by the NIS2Compass editorial team | As of: October 2026

The Cyber Resilience Act, Regulation (EU) 2024/2847, directly applies to anyone who manufactures, imports or distributes products with digital elements. Even if you sell purchased devices under your own brand, you may count as a manufacturer. The free CRA Applicability Check from NIS2Compass helps you identify your role with 20 questions, available as Word and PDF, with no email gate.

Why Isn't the NIS2 Applicability Check Enough for the CRA?

NIS2 asks whether your company, as an entity, has obligations. The CRA asks whether you place a product with digital elements on the EU market, regardless of sector and size. A company can therefore be a CRA manufacturer without being subject to NIS2, and vice versa.

NIS2 and the BSIG regulate the organisation, the CRA regulates the product. Art. 2 CRA is tied to products made available on the market, not to headcount or turnover. What the CRA is and how it relates to NIS2 is explained in a separate article.

The NIS2 applicability check answers the NIS2 question, the new check answers the CRA question. The two complement each other, and neither replaces the other. The thresholds and sectors behind the NIS2 question are covered in Am I affected by NIS2?. For implementing the NIS2 obligations, the NIS2Compass Template Library provides 45+ templates with section references.

Since 11 September 2026, the reporting obligation under Art. 14 has applied to manufacturers, including for products placed on the market before 11 December 2027 (Art. 69(3), Art. 71(2)). The remaining obligations for manufacturers, importers and distributors apply from 11 December 2027. According to the BSI press release of 11 September 2026, reports go through the ENISA platform CRA-SRP, with CERT-Bund at the BSI acting as the coordinating CSIRT. Whether you are a manufacturer already determines today whether you have a reporting obligation.

What Do the Five Sections of the CRA Applicability Check Cover?

The check works out your role in five steps: Is it a product with digital elements, do you make it available on the market, in which role, does the own-brand rule apply, and is the product listed in Annex III or IV? It ends with one of six result categories, each with a traffic-light rating.

• A: Product with digital elements? Software or hardware with a direct or indirect data connection to a device or network, including its remote data processing. Exclusions are set out in Art. 2(2) to (7) (Art. 2, Art. 3(1) and (2)).
• B: Making available on the market? This means supply in the course of a commercial activity, whether in return for payment or free of charge. Non-monetised open-source software is excluded (Art. 3(22), recitals 15 and 18).
• C: Which role? Manufacturer, importer or distributor (Art. 3(13), (16), (17)). If a manufacturer has given you a written mandate, you take on the tasks set out in that mandate as an authorised representative (Art. 3(15), Art. 18).
• D: Own-brand rule? Your own brand or a substantial modification turns importers and distributors into manufacturers from 11 December 2027 (Art. 21, Art. 3(30)). In practice, this is often called the own-brand trap.
• E: Product category? Important products (Annex III, Class I and II) and critical products (Annex IV) are subject to a stricter conformity assessment (Art. 7, 8, 32).

The six results are: not in scope, procurement role only, distributor, importer, manufacturer (including via the own-brand rule) and needs clarification. The traffic light shows the scope of your obligations, not a risk level. For five borderline questions, you can tick "Unclear". The result is then "needs clarification" instead of a forced answer.

Annex III lists 23 categories of important products, 19 in Class I and 4 in Class II, and Annex IV lists three categories of critical products. Two examples: smart meter gateways are explicitly listed in Annex IV, which matters for municipal utilities and energy suppliers. Routers, modems and switches are listed in Annex III, Class I.

For mechanical engineering companies with networked controls, sections C and D are the most important. The technical description of the categories is laid down in Implementing Regulation (EU) 2025/2392 of 28 November 2025.

The check follows the same structure as the management self-check under § 38 BSIG: yes/no questions, the legal basis next to each question, and an evaluation on a single page.

When Does a Distributor or Importer Become a Manufacturer?

From 11 December 2027, an importer or distributor counts as a manufacturer under Art. 21 CRA if it places a product on the market under its own name or trademark, or carries out a substantial modification. It is then subject to the manufacturer obligations under Art. 13 and 14. Whether relabelling already triggers the reporting obligation today has not been conclusively settled.

Suppose a mid-sized supplier in industrial automation buys a network-capable edge gateway from a manufacturer outside the EU. It resells the gateway to machine builders.

Before: The device carries the original manufacturer's brand. The supplier is an importer (Art. 3(16)). From 11 December 2027, it must, among other things, verify the conformity assessment, technical documentation and CE marking, provide its contact details and report vulnerabilities to the manufacturer (Art. 19). It keeps the EU declaration of conformity available for at least ten years or for the support period, whichever is longer (Art. 19(6)).

After: The supplier has the device shipped with its own logo and product name. From 11 December 2027, it counts as a manufacturer under Art. 21. It is then subject to the obligations under Art. 13, such as the requirements of Annex I, the conformity assessment and a defined support period, as well as the reporting obligation under Art. 14.

And today? Art. 14 has applied to manufacturers since 11 September 2026, including for products already on the market (Art. 69(3)). Art. 21 does not yet apply at that point.

There is, however, a reasonable argument that the supplier is already a manufacturer under the definition in Art. 3(13): it has the device manufactured and markets it under its own brand. This has not been conclusively settled. The check therefore flags this case with a note until 11 December 2027.

The difference also shows in the numbers. Infringements of the obligations of authorised representatives, importers and distributors (Art. 18 to 23) can be fined up to EUR 10 million or 2 % of worldwide annual turnover, infringements of Art. 13 and 14 up to EUR 15 million or 2.5 % (Art. 64(2) and (3)). Art. 64 applies from 11 December 2027. Your own label therefore raises the maximum fine from EUR 10 million to EUR 15 million.

From 11 December 2027, the same applies without a new label if the device is substantially modified, for example with new functions or interfaces (Art. 3(30), Art. 21). Anyone who is neither an importer nor a distributor, modifies a product in this way and passes it on counts as a manufacturer under Art. 22 from 11 December 2027, possibly only for the modified part. Pure security updates that do not change the intended purpose are not a substantial modification (recital 39). Section D of the check covers these scenarios, including the integration of purchased components into your own product.

Which Cases Can the Check Not Decide Clearly?

Three scenarios are especially often unclear: software that runs only in the browser, in-house developments used purely internally, and open source with paid support. On 27 July 2026, the European Commission published guidance with 67 examples on these questions, but it is not binding. The check flags such cases as needing clarification.

For SaaS and web applications, the Commission's interpretation is: a web application used exclusively in the browser is not in itself a product with digital elements (guidance, paras. 20 and 21, example 5). It does, however, form part of the product as remote data processing if the product cannot perform one of its functions without it and the software comes from the manufacturer (Art. 3(2), recitals 11 and 12). Cloud services such as SaaS fall under the NIS2 Directive (recital 12). This mainly affects IT service providers.

For in-house developments, it is open whether purely internal use within the company falls outside the scope. The CRA only covers products supplied to others in the course of a commercial activity (Art. 3(22)). Purely internal use is only expressly addressed for public administrations (recital 16). There is no express rule for passing software on to group companies or partners.

For open source, monetisation is decisive. Free and open-source software that is not monetised does not constitute a commercial activity (recital 18). If you provide sustained support for open source intended for commercial use, you may fall under a lighter regime as an open-source software steward (Art. 3(14), Art. 24).

Besides these three cases, the check also flags remote data processing and substantial modification as needing clarification if you tick "Unclear".

The Commission explicitly presents its guidance as a support tool. On the publication of the CRA guidance, Executive Vice-President Henna Virkkunen said: "This guidance is part of our simplification agenda, helping businesses meet their obligations under the Cyber Resilience Act on time and with confidence."

What to do next depends on your result:

• Manufacturer: Create a product list with versions and support periods, and set up your reporting channel via the CRA-SRP. How reporting under Art. 14 works is described in a separate article.
• Needs clarification: Compare the flagged questions with the relevant chapter of the guidance and have open points reviewed by an expert.
• Procurement role: When purchasing, ask about CE marking and the end date of the support period, which manufacturers must state at the time of purchase (Art. 13(19)).

Frequently Asked Questions

Does the CRA affect me if I only use connected products?

Not directly. Obligations under the CRA apply to economic operators, meaning manufacturers, authorised representatives, importers and distributors (Art. 3(12)). As a user, the CRA affects you through procurement: look for CE marking and the stated end of the support period (Art. 13(19)). Any organisation can also set its own requirements for procurement or use (recital 13).

Does the CRA apply to software as a service?

According to the European Commission's guidance, which is a non-binding interpretation, a pure web application that runs only in the browser is not a product with digital elements. It does, however, form part of a product as remote data processing if the product cannot perform one of its functions without it (Art. 3(2)). Cloud services such as SaaS themselves fall under the NIS2 Directive (recital 12).

Are small businesses exempt from the CRA?

Not from its scope: that depends on the product, not on company size (Art. 2). The Regulation does, however, provide for support, such as a helpdesk run by the coordinating CSIRTs for the reporting obligation (Art. 17(6)) and guidance focused on SMEs (Art. 26). Company size is also taken into account when setting fines (Art. 64(5)).

Is the result of the self-check legally binding?

No. The NIS2Compass CRA Applicability Check gives you guidance on your role, but it does not replace legal advice or a case-by-case assessment. What counts is the text of the Regulation and the authorities' interpretation, in Germany that of the BSI as market surveillance authority. Have questions you answered with "Unclear" reviewed specifically.