Cyber Resilience Act (CRA) - Scope & Applicability Check

Deloitte’s CRA Scope & Applicability Check provides a structured approach to identify which products within the client’s portfolio are in scope of the CRA (Products with Digital Elements and their Remote Data Processing Solutions) and which role(s) the organization assumes in the context of the CRA.

The service offers organizations a clear starting point for their CRA journey by establishing transparency on product scope and regulatory roles. It further highlights where AWS-supported services may be relevant for upcoming CRA compliance activities, thereby creating a solid foundation for subsequent assessment and compliance activities.

The offering is based on a Deloitte-developed Scope Check asset featuring structured decision-tree logic covering hardware, software, remote data processing, market operator roles, and initial product classification. The asset has been applied across multiple industries and serves as a proven basis for structured scoping.

As an initial step, Deloitte tailors the Scope Check asset to the client’s specific business context and collaborates closely with relevant stakeholders across Legal, Product Security, Compliance, and other functions. Deloitte facilitates the required working sessions, enables client teams to complete the Scope Check in a structured manner, and provides dedicated Q&A support to resolve open questions.

The result is a defensible and scalable foundation for further readiness assessments and compliance activities, including a clearer understanding of how AWS-supported services need to be included within the CRA compliance framework.

Note: This offering does not constitute legal advice but supports teams during the scoping phase.