Startups and small teams
The Cyber Resilience Act for startups
There is no small-company exemption in the CRA and no exemption for giving the product away. What there is, if you are small, is a genuine advantage: the reporting duty needs a named person and a written trigger, and a team of six can put both in place in an afternoon.
This page does not tell you whether the CRA applies to you. It cannot: the answer turns on inputs only you have. What it does is name the questions that decide it, with the article behind each, so the free check takes two minutes instead of an afternoon.
The assumption to check first
“We are too small, too early, or too free for this to be our problem yet.”
Size is not a scope test. Supply in the course of a commercial activity covers free products, and the Article 14 reporting clock does not scale with headcount: 24 hours is 24 hours whether you are six people or six hundred.
What actually decides it
Is it supplied in the course of a commercial activity?
Article 3(22), Regulation (EU) 2024/2847
Paid or free makes no difference. "Free" is the most common reason a team wrongly assumes it is out.
Is the product placed on the EU market?
Article 2(1), Regulation (EU) 2024/2847
Scope follows the market, not your address. A company outside the EU that sells into it is in; an EU company selling only elsewhere is not.
Is there a data connection in intended or foreseeable use?
Article 2(1), Regulation (EU) 2024/2847
Almost every modern product has one. This is rarely the leg that saves you.
Is it free and open-source outside a commercial activity?
Open-source steward provisions, Regulation (EU) 2024/2847
The one carve-out most likely to be relevant to a small team, and the one most often over-read.
What to do next
- 1.Run the scope check. Two minutes, no account, and you have a dated answer either way.
- 2.If it applies, name one person and one backup for reporting. That single step removes the most common failure.
- 3.Do the readiness check to see the rest, and fix the cheap gaps first.