CRA Dossier
How to determine if it is a product with digital elements?
Is Your Product Covered by the Cyber Resilience Act?
A dishwasher with wash-cycle firmware and no way to connect to anything is the classic example of a product outside the Cyber Resilience Act’s scope. The example is correct, but “it has no connectivity features” is not the legal test. Under Article 2(1), what matters is whether a data connection falls within the product’s intended purpose or reasonably foreseeable use. The Commission’s guidance of 27 July 2026 adds what counts as a data connection: digitally encoded information, sent according to a defined scheme and decodable at the other end. Switching an output on and off does not qualify. This dossier restates the CRA scope and product-with-digital-elements test and applies it to seven versions of the same dishwasher. It shows why a service header used to read fault codes brings a product within the Cyber Resilience Act’s scope, why a USB port used only for power does not, and why any product whose firmware can be updated in the field is in scope.
Written for compliance, engineering and product teams assessing embedded firmware, connected hardware and other potential products with digital elements for Cyber Resilience Act compliance.
Why does CRA scope matter?
Whether the CRA applies at all is the first question in any Cyber Resilience Act scope assessment. The dossier finds that the shorthand “no connectivity features, no CRA” can leave out products that are in scope and pull in products that are not. It misses service ports, update paths and connections through a host system, and it catches interfaces that carry no encoded information, such as a USB port wired only for power.
Because the CRA applicability test turns on foreseeable use, a manufacturer cannot document its way out of scope: telling users not to use a data port does not help if its use is foreseeable. A mechanism for updating firmware in the field will also ordinarily settle the question because the update requires digitally encoded information to be transferred to the product. A product whose embedded firmware can be updated in the field is therefore likely to be a product with digital elements within the CRA’s scope, regardless of whether the update arrives through a network, service interface or removable medium.
What is inside
- The operative texts governing Cyber Resilience Act scope: Article 2(1), the definitions of logical, physical and indirect connection and of reasonably foreseeable use, and the guidance’s definition of a data connection.
- The CRA scope test restated as two cumulative gates and a single criterion that scoping opinions and technical documentation can use.
- Seven dishwasher variants, from a unit with no interface of any kind to one controlled through a household gateway, each with a clear CRA applicability result.
- How separately supplied firmware is assessed, and why it will ordinarily be a product with digital elements even when the appliance is not.
- Five operational steps for CRA scope assessments, three monitoring triggers and caveats on the guidance’s non-binding status.
Who is it for
Compliance, engineering and product teams assessing embedded firmware, connected hardware and other potential products with digital elements for Cyber Resilience Act compliance.
Written by Daniel Thompson-Yvetot for CrabNebula Ltd. Not legal advice, not a conformity determination.
