CRA scope — product, market and responsibility
Scope depends on the product and how it is made available, not merely the labels SaaS, in-house or open source.
Product boundary
Describe hardware, software and necessary remote data processing. Consider direct and indirect connectivity in intended and reasonably foreseeable use. Determine who designs the remote processing or is responsible for it.
Market and role
Examine commercial availability on the EU market, the name under which the product is supplied and the economic operator's role. A customer-specific on-premises deployment can still need analysis; an internal-use label is not enough.
Exclusions and uncertainty
Compare the precise sector and product category with Article 2. Do not infer an exclusion solely from healthcare, automotive or aviation terminology. Keep unknown facts open and retain the rationale and evidence behind the conclusion.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.