Which EU regulations apply to my product?

It depends on what the product is and how it is placed on the market. The Cyber Resilience Act covers products with digital elements; the Machinery Regulation covers machinery and related products. A connected machine can be subject to both, along with EMC, the Low Voltage Directive and RoHS.

Is this tool legal advice?

No. It applies simplified logic to the answers you give and cannot see your product. Treat the result as a starting point for further work, never as a determination of your legal position.

Compliant Book

EU compliance checker

Six questions. At the end you get the regulations that apply, the conformity assessment route each one puts you on, and what to read next.

This is an educational tool, not advice. It applies simplified logic to the answers you give and cannot see your product. Use the result as a starting point, not as a determination of your legal position. Disclaimer →

Question 1 of 6

Question 1 What is your product?

Pick the closest description. Software includes mobile and desktop applications, firmware and embedded software.

Software — an application, firmware, embedded software or a library Connected hardware — a device that communicates with a device or network Machinery, or a related product such as a safety component or lifting accessory Machinery that contains software or a network connection None of these — an unconnected, purely mechanical or purely electrical product

Question 2 Is it placed on the EU market in the course of a commercial activity?

Placing on the market means the first making available in the EU. Selling from outside the EU to EU customers counts. Non-commercial open source is a separate case.

Yes — we sell it, or monetise it commercially, to customers in the EU No — it is open source, published outside any commercial activity No — it is never made available in the EU

Question 3 Is it excluded by sector-specific legislation?

The Cyber Resilience Act excludes products already covered by certain sector regimes.

None of these apply It is a medical device, a motor vehicle, civil aviation equipment, marine equipment, or developed exclusively for national security or military purposes

Question 4 Does it fall into an Annex III or Annex IV category?

These are the important and critical product categories. Read them functionally — a device that includes a VPN function is caught by the VPN entry whatever you call the product.

No — none of the listed categories describe what it does Class I — for example an operating system, browser, password manager, router, VPN, network management, SIEM, boot manager, PKI software, smart home security product, connected toy or health wearable Class II — a hypervisor or container runtime, a firewall, an intrusion detection or prevention system, or a tamper-resistant microprocessor or microcontroller Critical — a hardware security box, a smart meter gateway, a smartcard or secure element I am not sure Not applicable — this is not a product with digital elements

Question 5 For machinery only: is it listed in Annex I of the Machinery Regulation?

Part A is six categories where a notified body is always required. Part B is a longer list where self-assessment survives if harmonised standards are applied in full.

Not machinery — skip this question Not listed in Annex I at all Part B — for example woodworking machinery, presses, moulding machinery, underground machinery, lifting of persons over three metres, presence-detection devices, safety logic units, ROPS or FOPS Part A — removable mechanical transmission devices or their guards, vehicle servicing lifts, portable cartridge-operated fixing or impact machinery, or a safety function using machine learning with self-evolving behaviour I am not sure

Question 6 For machinery only: will you apply harmonised standards in full?

Applying the relevant harmonised standards in full, where they cover all applicable essential health and safety requirements, is what keeps Annex I Part B products in self-assessment.

Not machinery — skip this question Yes — the relevant harmonised standards will be applied in full No, or only partially, or no standard covers all the applicable requirements I am not sure

The logic, written out

Nothing here is hidden in code. This is exactly what the checker does with your answers.

Cyber Resilience Act

How answers map to a Cyber Resilience Act outcome
If	Then
Software, connected hardware, or machinery with software or a connection	Potentially a product with digital elements — continue
Not made available in the EU	Out of scope of the CRA
Open source, published outside any commercial activity	Excluded as non-commercial open source. Steward duties may apply to a supporting foundation. Detail →
Medical device, motor vehicle, civil aviation, marine, or national security or military	Excluded by sector legislation
In scope, no Annex III or IV category	Module A — self-assessment, no notified body
In scope, Annex III Class I	Module A only if harmonised standards or a certification scheme are applied in full; otherwise Module B+C or Module H
In scope, Annex III Class II	Module B+C, Module H, or a certification scheme at level substantial. Notified body required
In scope, Annex IV critical	European cybersecurity certification where mandated by delegated act; otherwise the Class II routes
In scope, in any class	Article 14 reporting applies now. Full obligations from 11 December 2027

Machinery Regulation

How answers map to a Machinery Regulation outcome
If	Then
Not machinery or a related product	Machinery Regulation does not apply
Machinery, not listed in Annex I	Internal checks — self-assessment
Annex I Part B, harmonised standards applied in full	Internal checks — self-assessment
Annex I Part B, standards not applied in full	EU type-examination plus conformity to type, or full quality assurance. Notified body required
Annex I Part A	Notified body required regardless of standards
Any machinery in scope	Regulation (EU) 2023/1230 applies from 20 January 2027. No transition period

Get told when the requirements change

None of the 35 CRA harmonised standards is published yet. When they land — and when deadlines move — we email you. No more than twice a month.