Regulation (EU) 2024/2847 · Chapter

Article 2 — Scope

What the Regulation covers, and the carve-outs that take products out of it.

LAW Official text — verbatim from the Official Journal snapshot; only the Official Journal is authentic.

1.1. This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.

2.2. This Regulation does not apply to products with digital elements to which the following Union legal acts apply:
(a) Regulation (EU) 2017/745;
(b) Regulation (EU) 2017/746;
(c) Regulation (EU) 2019/2144.

3.3. This Regulation does not apply to products with digital elements that have been certified in accordance with Regulation (EU) 2018/1139.

4.4. This Regulation does not apply to equipment that falls within the scope of Directive 2014/90/EU of the European Parliament and of the Council .

5.5. The application of this Regulation to products with digital elements covered by other Union rules laying down requirements that address all or some of the risks covered by the essential cybersecurity requirements set out in Annex I may be limited or excluded where:
(a) such limitation or exclusion is consistent with the overall regulatory framework that applies to those products; and
(b) the sectoral rules achieve the same or a higher level of protection as that provided for by this Regulation.
The Commission is empowered to adopt delegated acts in accordance with Article 61 to supplement this Regulation by specifying whether such limitation or exclusion is necessary, the products and rules concerned, as well as the scope of the limitation, if relevant.

6.6. This Regulation does not apply to spare parts that are made available on the market to replace identical components in products with digital elements and that are manufactured according to the same specifications as the components that they are intended to replace.

7.7. This Regulation does not apply to products with digital elements developed or modified exclusively for national security or defence purposes or to products specifically designed to process classified information.

8.8. The obligations laid down in this Regulation shall not entail the supply of information the disclosure of which would be contrary to the essential interests of Member States’ national security, public security or defence.

BINDING Source: Regulation (EU) 2024/2847 (Cyber Resilience Act) · publisher European Union · captured 2026-09-16 · snapshot sha256:27b7c6c64c773001… · CELEX 32024R2847

What this article does

Article 2 does the sorting. The Regulation applies to products with digital elements made available on the market in the course of a commercial activity F-007, where a product with digital elements means a software or hardware product including its remote data processing solutions, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network F-005.

The carve-outs are specific, not thematic: products covered by the medical devices, in vitro diagnostics or motor-vehicle type-approval Regulations, civil aviation products certified under Regulation (EU) 2018/1139, marine equipment under Directive 2014/90/EU, spare parts made to identical specifications, and products developed or modified exclusively for national security or defence or designed to process classified information are excluded F-010. A cloud service that is not part of a product falls outside this Regulation and under NIS2 instead F-008.

How to actually use this article

Read it as three questions in order. Is there a product with digital elements F-005? Is it made available commercially — noting that ad-funded and freemium both count as commercial activity F-007? Does one of the Article 2 carve-outs take it out F-010? Answering in that order prevents the most common scoping error: arguing about carve-outs for something that was never in scope, or assuming a free product is out when its distribution is commercial F-007.

Verified facts this page relies on

F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1)
F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals
F-010 Excluded: medical devices (Regulation (EU) 2017/745) and in vitro diagnostics (2017/746) and motor-vehicle type-approved products (2019/2144) (Art. 2(2)); civil aviation products certified under Regulation (EU) 2018/1139 (Art. 2(3)); marine equipment under Directive 2014/90/EU (Art. 2(4)); spare parts made to identical specifications (Art. 2(6)); products developed or modified exclusively for national security or defence, or designed exclusively to process classified information (Art. 2(7)). Art. 2(2)–(4), (6)–(7)
F-008 Cloud services that are not part of a product are outside the Regulation (they fall under NIS2); remote data processing essential to a product is within scope as part of that product. Art. 3(1)–(2), Recitals

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Not sure whether this applies to your product? Check if the CRA applies to you on CRARequired.