Use a four-part test: identify the product and intended purpose, check for an express CRA exclusion, check for any Article 2(5) delegated limitation, then map all other applicable EU acts that continue to apply in parallel. Where several laws regulate the same product, reuse consistent architecture, risk, testing and supplier evidence, but preserve law-specific scope decisions, conformity routes, documentation requirements and declarations.
Existing Regulation Is Not the Same as CRA Exclusion
The EU product framework routinely applies several legal acts to the same product. The CRA therefore does not contain a blanket rule excluding every already regulated product. The manufacturer should look for a specific Article 2 exclusion or limitation instead of assuming that an older CE-marking or sectoral law takes priority automatically.
Some Product Categories Are Expressly Excluded
Medical devices, in vitro diagnostic medical devices and products covered by the specified motor-vehicle framework are examples of express Article 2 exclusions. Certain aviation-certified products and marine equipment are also excluded. For those products, the sectoral legal framework supplies the relevant conformity route instead of the CRA.
Other Regulated Products Can Remain Fully Within CRA Scope
A connected machine, radio product, consumer product or AI-enabled product can remain within CRA scope if no exclusion or limitation applies. The other Union act may regulate safety, radio performance, data, AI risk or another objective while the CRA governs horizontal product cybersecurity and vulnerability handling.
Different Laws Can Regulate Different Risks in the Same Product
A connected product can raise cybersecurity, physical safety, privacy, data-access and civil-liability issues at the same time. The legal frameworks do not need to be identical to operate together. Map each significant product risk to the legal act that addresses it and identify where technical controls support more than one legal obligation.
Article 2(5) Can Change the Result for Sector-Specific Products
Where another Union regime addresses all or some Annex I risks at the same or a higher level of protection, the Commission can adopt a delegated act limiting or excluding CRA application for specified products and rules. Until the legal conditions and delegated measure exist, do not treat sectoral overlap alone as an Article 2(5) exclusion.
Shared Technical Documentation Can Reduce Duplication
Architecture diagrams, software inventories, cybersecurity risk analysis, test reports, supplier records and change history can often be reused across several regulatory files. The shared evidence should be controlled and versioned, with mappings showing which requirements under each law it supports.
Separate the Conformity Route for Each Applicable Act
Different Union acts can provide different conformity modules, standards, notified-body roles or type-approval procedures. The manufacturer should determine the legally available route under each act. A notified-body assessment under one law does not automatically satisfy the CRA unless the CRA itself provides a mechanism giving that assessment legal effect.
Keep Product Changes Connected to Every Applicable Law
A software, hardware, remote-service or intended-purpose change can alter CRA scope, another product-law classification or both. Central change control should identify all applicable acts for the product and trigger the relevant legal and technical reassessments rather than updating only the CRA file.
Use One Regulatory Applicability Record Per Product
A practical product record should list every potentially applicable EU act, the scope conclusion, exclusions, classifications, conformity route, responsible team, technical-documentation location and review trigger. This prevents the same product being analysed independently by cybersecurity, safety, privacy and quality teams with inconsistent boundaries.
Do Not Treat Existing CE Marking as Proof of CRA Conformity
A product already bearing CE marking under another act does not automatically satisfy CRA requirements. Once the CRA applies to that product, the manufacturer must complete the CRA obligations and conformity procedure applicable to it and ensure the EU declaration and CE-marking framework reflect all relevant legislation.
Coordinate Market-Surveillance Evidence
Different authorities can request evidence under different Union regimes. A controlled master evidence system can reduce contradictory submissions, but teams should still identify the legal basis and scope of each authority request and provide the records required under the applicable act.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.