What is the scope of the EU Cyber Resilience Act?

All "products with digital elements" placed on the EU market, including their remote data processing such as update backends and connected cloud services. Fields with their own sector rules, such as medical devices, motor vehicles and civil aviation, are excluded.

The CRA (Regulation (EU) 2024/2847) is horizontal. Instead of one law per product type, it sets baseline requirements for almost everything with software in it: consumer IoT, routers, apps, operating systems, industrial components.

• Included: hardware and software, plus their remote data processing. A smart lock's cloud backend and its over-the-air update server are part of the product.
• Excluded: products already covered by sector rules, notably medical and in-vitro diagnostic devices (MDR/IVDR), motor vehicles and civil aviation, as well as products for national security and defence.
• Relationship to other law: it supplements, not replaces, the RED, the AI Act and NIS2.

Go deeper:

• European Commission — Cyber Resilience Act — official summary of scope and obligations
• Cyber Resilience Act (Wikipedia) — history, exclusions and the open-source debate