CRA, NIS2 & IEC 62443 Applicability Checker

Step 1: Your product

What best describes your product?

Hardware with embedded software Software product (desktop, mobile or server) Cloud/SaaS service Software component or library OT / industrial control product

Which description fits its CRA scope?

Medical/IVD devices covered by MDR/IVDR are excluded. Health-sector use alone is not an exclusion. Open source alone is not an exemption.

CRA scope and exclusions (opens a new tab)

Commercial supply, with no known CRA exclusion Covered by a CRA Article 2 product exclusion Unsure, including non-commercial/open-source cases

Step 2: Market and connectivity

Is the product made available on the EU market?

Yes Not yet, but planned No, and not planned

Can it exchange data with another device or network?

Include intended or reasonably foreseeable connections through other systems.

Yes, via the internet Yes, locally or indirectly (including USB/Bluetooth) No direct or indirect data connection Unsure

Step 3: Your organization

Does your organization provide services or carry out activities in the EU?

This is separate from where this particular product is sold.

Yes No Unsure / planned only

What is your organization’s size under EU SME rules?

Use staff and financial thresholds, including partner/linked enterprises; headcount alone is not enough.

EU SME definition (opens a new tab)

Micro or small Medium Large Unsure

Step 4: Activity and intended use

Which activity does your own organization perform?

Choose your own activity, not your customers’ sector. Other activities can also be covered by NIS2.

Energy Transport Healthcare / pharmaceuticals Manufacturing: medical devices, electronics, electrical equipment, machinery or transport equipment Cloud, data centres, managed IT/security or other digital infrastructure DNS, TLD registry, trust services or public telecoms Banking, financial infrastructure or other finance Other activity / unsure

Is the product intended for industrial automation or control systems?

Consider its intended use, including use by your customers, in any sector.

Yes No Unsure

Your applicability report

Initial screening, not a compliance determination. Reviewed 14 October 2026.

Other frameworks to consider

NIST CSF 2.0 offers voluntary guidance for organizations of any size or sector.

Radio Equipment Directive scope needs a separate radio-equipment assessment. These answers do not establish whether a product uses radio; local connectivity does not mean wired-only.

Discuss your next steps

Add automated compliance checks to your development pipeline with Argus. Start with supplied rule sets or your own procedures, make failures visible to the team, and capture evidence on every run.

Learn more about Argus