Cyber Resilience Act decision examples
CRA classification
Connect the product’s core function to its class and conformity-assessment route. Compare worked examples and the evidence behind each CRA assessment.
Which product class and conformity route apply?
Open a situation to compare the relevant facts, worked results and evidence to retain.
Which CRA conformity route applies to a router?
First match the core routing function to the legal category. For a Class I example, the available internal-control route depends on the applicable conformity basis and its coverage.
View facts and examplesDoes a CRA firewall assessment require a third party?
A documented Class II firewall example normally requires a qualifying third-party route. Merely selecting internal control does not make that route available.
View facts and examplesDoes an embedded operating system change a product’s CRA class?
Classification follows the core functionality of the product being supplied. The presence of an operating-system component alone does not settle the classification of the whole product.
View facts and examplesCan commercial open-source software use CRA internal control?
A specific route exists for qualifying free and open-source products, with conditions including public technical documentation. Being open source is not enough by itself.
View facts and examplesHow to use these examples
The situations are hypothetical and use explicitly recorded assumptions. They explain a decision path, not a conclusion about your own product. Reporting obligations for manufacturers apply from 11 September 2026; broader product requirements apply from 11 December 2027.
Product-readiness examples support preparation for those broader requirements. A readiness result does not declare conformity. Primary sources and the assessment version are provided on each situation page.