Free tool · no account needed

Scope check

Does the Cyber Resilience Act apply to your product, and which class is it in?

The applies to supplied commercially in the EU (Regulation (EU) 2024/2847, Article 2). A product whose core function is on the Annex III or Annex IV lists is . Answer a few questions to see where yours lands.

The answers stay in this browser tab unless you press "Save this product", which carries them in the sign-in link so the wizard can pre-answer the class. The result is a first reading for you to check, not a ruling.

Do you supply this product in the EU as part of a business?

The CRA covers products "made available on the market": supplied for distribution or use in the EU in the course of a commercial activity, whether paid or free. Selling it, bundling it with a paid service, or giving it away to win business all count. For free and open-source software the question is whether you monetise it, not how it was developed or who paid for the development (recital 18). Recital 15 lists what monetising includes: charging for the software, charging for technical support beyond recovering your actual costs, using the software as a platform to sell other services, requiring personal data as a condition of use for reasons other than security, compatibility or interoperability, and accepting donations that exceed your costs; it adds that accepting donations without the intention of making a profit is not a commercial activity. The Commission's draft guidance C(2026) 5252 (27 July 2026; not binding and not yet formally adopted) says how it reads two items on that list. Donations: on that reading the test is not the amount but whether access to the software, to essential functions or to updates depends in practice on donating, or whether donors get contractual benefits beyond community perks; software supported only by voluntary donations is unlikely to count as monetised (points 61 and 62). Support: on that reading, optional paid services such as consultancy, training or installation help, sold separately while anyone can still download and install the software freely, do not count; a paid version or edition that comes with support does (points 55 to 57). Not-for-profits: recital 18 says that developing free and open-source software is not a commercial activity for a not-for-profit organisation set up so that all earnings after costs go to not-for-profit objectives; the draft guidance reads this as covering such a publisher even where the software earns money, and as making it likely an open-source software steward with the lighter Article 24 duties instead of a manufacturer (point 66). If that describes you, choose the open-source organisation answer.

Reading the current legal state…

What happens to your data

What you type stays in this page unless you press the button to continue — then your answers go with you in the sign-in link, so the next step starts filled in.

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.