What counts as a product with digital elements under CRA

The Cyber Resilience Act does not start with a scanner, an SBOM format or a CE workshop. It starts with a definition. Regulation (EU) 2024/2847 applies to a product with digital elements (PDE) placed on the Union market. If you cannot list those products, every later artefact is attached to the wrong object.

A PDE is not only a box of electronics. Standalone software sold under your name is a PDE. A component sold separately is a PDE. The dates - 11 September 2026 and 11 December 2027 - are the same.

Who the regulation is talking to

The primary addressee is the manufacturer: the person who places the product on the Union market under their name or trademark. That is a legal role, not a job title on LinkedIn. If you put your mark on a device built by someone else, you are the manufacturer for CRA. If you import a non-EU product and place it on the market, you pick up manufacturer duties.

Importers and distributors have their own checks. They do not replace the manufacturer’s file. An authorised representative does not write the risk assessment for you.

The unit of duty is the product, not the legal entity once. Two SKUs are two files even if they share a firmware tree. A substantial modification is a new placing on the market: the catalogue gets another row, the SBOM another lock, the declaration another date.

Device, software, component

The text is horizontal on purpose. Hardware with digital elements is in. Software that is made available on the Union market under your name is in, including embedded software sold on its own. A library, an SDK, an industrial runtime, a mobile app that you place on the market as a product: if the name on the listing is yours, start from the assumption that it is a PDE and document why not, if you think it is not.

“We only sell software” is not an exemption. “It runs in the cloud” is a different conversation about what you actually place on the market as a product. “It is a component inside someone else’s machine” still matters if you sell that component separately under your mark.

What you need on each row is boring and specific:

• name and version,
• type (device / standalone software / component),
• markets where you make it available,
• the date of placing on the market or making available,
• the support end with month and year, stated at purchase,
• who the manufacturer is for this row,
• whether a substantial modification happened.

Without those fields you cannot attach an SBOM, an Annex I gap or an Article 14 notification to anything an authority would recognise.

Scope is a per-product decision

CRA is not a company badge you earn in 2027. On each PDE you decide whether the regulation applies, who the manufacturer is, and whether the latest change was substantial. That decision belongs in the catalogue, next to the evidence, not in a slide titled “we are in scope”.

Products already made available before 11 December 2027 are not outside the story. New placing on the market after that date needs Annex I, conformity assessment, the EU declaration and the CE mark. A substantial modification of an older product is treated as a new placing. Planning “only new products” without a definition of substantial modification is how a 2024 SKU becomes a 2028 problem.

Why the catalogue has to exist before Article 14

On 11 September 2026 the manufacturer notifies actively exploited vulnerabilities and severe incidents. The notification points at a product. If the product lives in an email thread, you will spend the 24-hour window looking for the version string.

The same catalogue feeds the 11 December 2027 file: identity, risk, Annex I, SBOM, support period, instructions, declaration, mark. A scanner does not create that identity. It consumes it.

What to put in the first week

1. List every name you place on the Union market, including software and sold-separately components.
2. Give each one a version, a type, markets and a support end with month and year.
3. Mark the manufacturer of record and any substantial modification.
4. Attach the SBOM and the Annex I risk row to that identity, not to the company.
5. Keep the catalogue on-premise. It is the index of the technical file.

Crado AI is built as that index: a PDE catalogue first, then risk, SBOM, Article 14 and CE. If the row does not exist, the rest of CRA has nowhere to sit.