Cyber Resilience Act
Does this law apply to you?
Six questions, two minutes. Find out whether the Cyber Resilience Act covers your product, which group it falls into and which dates apply.
What you make
Question 1 of 6
Six questions, two minutes
We ask what you make, whether it connects to anything, how and where you sell it, how it is installed and what it does. Published rules turn your answers into a result: covered or not, which group your product falls into, which dates apply.
The rules are the same ones our paying customers get. No chatbot is involved in the answer. It works wherever your company is registered: the law follows the product into the EU market, so a maker outside Europe that sells into it gets the same result as one inside.
The check is free, it stays free, and you can act on the result without ever speaking to us.
What your result means
Likely covered. Your answers match a rule that brings the product under the law. The result names the rule and the fact behind it.
Likely not covered. Your answers match an exception: no EU market, no commercial activity, nothing that connects, or another rulebook that takes over. Read the reason — a small change in the facts can change the outcome.
Needs a closer look. Your answers sit on a line the rules do not settle on their own: the cloud half of a product, open source with money around it, or a product that could belong in more than one group. A scoping memorandum settles it.
Your group. Ordinary, important class I or II, or critical, with the reference. If the group comes from something specific you chose, the result says which; if it is ordinary because nothing you chose is listed, it says that too.
Your dates. The two that matter, and what each one brings.
Manufacturers' reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026.[Art. 71(2); Art. 14] The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)]What to do next. Three steps, in order, sized to your result.
This is our engineering reading of the law, not a legal ruling. As the manufacturer, the final call on scope and group is yours. The written opinion is where we put our name to ours.
What happens to your answers
You can finish the check and read your result without giving us an email address. An email is needed only if you want the result as a PDF.
If you give one, we keep your answers, your result and your address, and we may follow up once about it. We do not sell or share it. The analytics on this site use no cookies. Details are in the privacy notice.
After the result
The check tells you where you stand. A call tells you what it would take — or write, and we answer within one working day. Either way you keep the result and the choice of what to do with it.