Who does the Cyber Resilience Act apply to?

The CRA applies to economic operators in the supply chain of products with digital elements that include a direct or indirect data connection (Art. 2, 3).

Two questions settle scope. Answer both before working out which operator you are -- if either comes back negative, the rest of the CRA does not reach you.

Two positives and you are a manufacturer under the CRA, wherever your company is established.

Question two is the one most often answered wrongly, because indirect counts: a sensor that reaches the internet only through a gateway is in scope. Question one carries its own trap -- hosting is not a safe harbour when the product depends on it. Software a manufacturer builds to run at a distance, which the product needs to perform a core function, is treated as part of the product (Art. 3(2)).

Manufacturers carry the primary obligations: secure design, technical documentation, conformity assessment, vulnerability handling, SBOM and incident reporting. A manufacturer established outside the EU must appoint an authorised representative in the EU, or otherwise ensure an EU-established economic operator performs the relevant tasks under Article 4 of Regulation (EU) 2019/1020 (CRA Art. 18). This is commonly fulfilled through the importer, an appointed authorised representative, or a fulfilment service provider.

Importers may place only compliant products on the EU market and must verify that the manufacturer completed its obligations. If the importer has reason to believe the product does not conform, it may not place it on the market.

Distributors must act with due care and satisfy themselves that the CE marking and required documentation are in place before making a product available.

OEM supply chain. The CRA places obligations on the entity that places the product on the EU market under its own name or trademark. An upstream OEM developer that supplies components or white-label hardware to a third party is not the "manufacturer" for CRA compliance purposes unless it also markets the finished product directly. If a software house supplies a module that another company integrates and brands, the branding entity is the manufacturer and carries the CRA burden. Compliance follows the brand on the box, not the origin of the technology.

Extraterritorial reach. A company established in the United States, Canada, or anywhere outside the EU that sells products with digital elements into the Union is in scope.

Exclusions. Products already subject to sector-specific EU rules with equivalent requirements are excluded -- medical devices (MDR/IVDR), motor vehicles (type-approval) and civil aviation (EASA). Non-commercial open-source software developed outside a commercial activity is largely outside scope.