Product with digital elements

This is the CRA's foundational scope term. It covers standalone software, hardware with embedded software, and the remote data processing that a manufacturer intends the product to use — such as a cloud back end a device depends on for a core function. Deciding whether something falls within this definition is the first and often most consequential step in a CRA scoping exercise.

Scope boundaries that matter

• Products already covered by certain sector-specific regulations, such as medical devices or motor vehicles, are excluded from CRA obligations that overlap with those regimes.
• Free and open-source software is excluded when developed and supplied outside the course of a commercial activity.
• A product with no network or data connection of any kind, direct or indirect, generally falls outside the definition.

The 'indirect' connection language is where scoping goes wrong in practice. A device that never itself connects to a network but is configured or updated via a connected accessory can still be in scope, because the connection is indirect rather than absent.

A defensible scoping decision documents the product's actual connectivity, the exclusions considered, and the reasoning for including or excluding each remote data processing element — not just the conclusion.