Does the Cyber Resilience Act apply to my product?

Scope is assessed per product, not per sector or company. A manufacturer with some in-scope and some out-of-scope products must classify each line separately.

• Check whether the product has a data connection, direct or indirect.
• Check whether an equivalent sector-specific regime already covers cybersecurity for that product.
• Classify as default, important or critical, since this determines the conformity assessment route.