Cyber Resilience Act
Does the Cyber Resilience Act apply to your product?
Eight steps, two minutes. Whether the Act covers your product, which duties are yours, and the article behind every answer.
What you make
Step 1 of 8
Eight steps, two minutes
We ask what you make, what your part in it is, whether it connects to anything, how and where you sell it, whether it is already out there, how it is installed, whether another rulebook already covers it, and what it does. Published rules turn your answers into an answer: whether the Act applies to your product, which duties are yours, which group your product falls into, which dates apply. You get the conclusion in one sentence first, then the reasoning, then the article.
The rules are the same ones our paying customers get. No chatbot is involved in the answer. It works wherever your company is registered: the law follows the product into the EU market, so a maker outside Europe that sells into it gets the same result as one inside.
Every answer names the article it applies. You cannot act on "we think this applies to you". Each line of your result carries the provision behind it: the plain sentence first, then the article and paragraph and a few words saying what that provision does, so you or your lawyer can go straight to the text. The tests are fixed; what changes from one company to the next is the facts of the product, and only you have those. So every answer takes the same shape — on the facts you gave us, the test in this article produces this result.
Two of the tests rest on softer ground, and the result labels them rather than sounding certain. The first is changing somebody else's product. The law sets the test — does the change affect compliance with the essential requirements, or the intended purpose the product was assessed for — and we ask you both halves of it; where the line falls in a close case is what the Commission's own guidance is meant to settle, and that guidance is not out yet. The second is open source. What binds is whether the software is supplied in the course of a commercial activity, and we ask you that; the familiar examples about making money from it sit in the recitals — the explaining part at the front of the regulation — which say what the legislator meant but are not themselves rules. Both still get an answer. What the result adds is a line saying which kind of ground it is standing on.
Who you are to the product is a second question. If you have a product built for you and sell it under your own name, you are the manufacturer, whether you charge for it or give it away. Put your own name on somebody else's product and you become its manufacturer too, for the whole product and not only the part you touched. Import it, or resell it unchanged, and your duties are checking duties: there is a guide written for you. Keep an open-source project alive for others and the regime is lighter again. The question is optional — skip it and you still get a result about the product.
The check is free, it stays free, and you can act on the result without ever speaking to us.
What your result means
The Act applies to this product. Your answers meet a test the Regulation sets, so the result says so in a sentence, at the top, and then shows its working: the test, the article it comes from, and the fact of yours that satisfies it.
The Act does not apply to this product. Your answers meet an exclusion, or they fall outside what the Regulation reaches: no EU market, services only with no product of your own, nothing that connects, or something used only inside your own company. The result names the fact doing the work, because change that fact and the answer changes with it.
One fact decides it, and a questionnaire cannot establish it. The law sets the test; sometimes applying it needs something only you can find out — whether a certificate was issued, whether a change altered what the product was assessed for. Where that happens the result names the fact and the article that turns on it, so you leave knowing what to go and check. It is not a way of avoiding the question, and it is the only answer we hedge.
Your group. Ordinary, important class I or II, or critical, with the annex point it comes from and the article that makes core functionality the test. If the group comes from something specific you chose, the result says which; if it is ordinary because nothing you chose is listed, it says that too. Where the wording we show you comes from the binding technical description of a category rather than the annex heading alone, the result names that act as well.
Your dates. What each one brings, and which of your products it reaches. Products already on the EU market before the December 2027 date are treated differently from ones that arrive after it — but only for part of the law. The reporting duty is expressly carved out of that relief and reaches them anyway, so the result states both limbs rather than one.
Manufacturers' reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026.[Art. 71(2); Art. 14] The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)] Products placed on the market before 11 December 2027 fall under the essential requirements only if they are substantially modified from that date onwards, but the Article 14 reporting obligations are expressly carved out of that relief and apply to every product in scope that was placed on the market before then. From 11 September 2026 the reporting duty therefore covers a manufacturer's whole installed base, not only what it sells from now on.[Art. 69(2), 69(3)]What to do next. Three steps, in order, sized to your result.
This is our engineering reading of the law, not a legal ruling. As the manufacturer, the final call on scope and group is yours. The written opinion is where we put our name to ours.
What happens to your answers
You can finish the check and read your result without giving us an email address.
An email is needed only if you want the result as a PDF or want to book a call: the same step does both.
If you give one, we keep your answers, your result and your address, and we may follow up once about it. We do not sell or share it. This site sets no cookies of its own and runs no analytics. Details are in the privacy notice.
One part of this leaves our own systems, and it is worth knowing before you type. Sending the email step is what opens the booking calendar, so it connects your browser to Zoho whether or not you go on to pick a time. The calendar is Zoho Bookings, run by Zoho Corporation B.V. in the Netherlands on Zoho's European data centre, and from the moment it appears Zoho has your address and your IP address. If you do pick a time, Zoho also holds the appointment, the name you type and your answer to its one question, and the call is held on Zoho Meeting, which is Zoho's too. The consent box says this before you tick it, and the privacy notice names every company in the chain, including one that was briefly connected to it in the past.
After the result
The check answers the question. What it takes to be ready — in what order, what it costs, and what you can do without us — is the next one. Every price is on the pricing page, so you can cost the work without asking anybody. The last step of this page is where you ask it: leave an email for the PDF and the calendar opens under it — thirty minutes with an engineer, at a time the calendar offers. If you would rather write, the link at the end of your result and the contact page both reach us, and we answer within one working day. Either way you keep the result and the choice of what to do with it.