Yes. The CRA covers any "product with digital elements" placed on the EU market: hardware running software, standalone software, or both. Research-use and non-medical lab equipment is firmly inside scope. This includes gel imagers, plate readers, mass spectrometers, sequencers, microarray scanners, and almost any modern laboratory instrument that ships with software, drivers, or network connectivity.

Yes. The CRA applies to anyone placing products on the EU market, regardless of where the company is headquartered. If you ship into the EU, you fall under the regulation. Non-EU manufacturers also need an authorised representative inside the EU, which is a new obligation worth planning for.

Products fully covered by the MDR or IVDR are excluded from the CRA's direct application, because those regulations have their own cybersecurity provisions. However, the technical principles increasingly align, and any non-medical components, accessories, or analysis software you ship alongside the regulated device may still fall under the CRA. We recommend a product-by-product gap analysis rather than a blanket assumption either way.

The CRA defines it broadly: any software or hardware product, plus its remote data processing solutions, where the absence of those data processing solutions would prevent the product from performing its function. In plain terms: if your instrument needs software to do its job, the whole thing is in scope. This includes embedded firmware, accompanying analysis software, drivers, mobile apps, and cloud-connected components.

Annex I of the CRA lists the essential requirements. In practical terms, products must: be designed and developed with cybersecurity in mind from the start, be delivered without known exploitable vulnerabilities, have a secure default configuration, protect data confidentiality and integrity, minimise attack surface, support secure updates, log security-relevant events, and provide users with clear information about how to use the product securely.

The CRA requires a support period that reflects how long the product is reasonably expected to be in use, with a default minimum of five years. For life science instruments that often remain in service for ten or fifteen years, this means committing to a substantial security maintenance horizon. The support period must be communicated clearly to customers at point of sale.

Yes. Security updates that address vulnerabilities must be provided to users without charge for the duration of the support period. This is separate from feature updates, which can still be paid. The update mechanism itself must be secure (signed updates, secure delivery channels) to meet the essential requirements.

Most products can be self-assessed by the manufacturer, who then issues an EU Declaration of Conformity and applies CE marking on a cybersecurity basis. Products classified as "important" (Class I or Class II) may require either application of harmonised standards plus self-assessment, or third-party assessment. Products classified as "critical" require a third-party conformity assessment by a notified body. Most life science laboratory instruments will fall into the standard or important categories rather than critical.

The CRA's Annex VII specifies the technical documentation. This includes a general description of the product, its intended purpose and reasonably foreseeable use, a cybersecurity risk assessment, a description of the design and architecture, the SBOM, evidence of how each essential requirement has been met, the procedures for handling vulnerabilities, and records of all conformity assessment activities. The documentation must be retained for ten years after the product is placed on the market.

CE marking under the CRA is in addition to, not a replacement for, any other CE marking your product already requires (e.g. for safety under the Low Voltage Directive). The CE mark on a CRA-compliant product signifies that the cybersecurity essential requirements have also been met. Manufacturers issue a single EU Declaration of Conformity covering all applicable EU regulations.

We modernise your existing analysis and instrument software to meet the CRA's essential cybersecurity requirements, white-labelled under your brand. Engagements typically include: gap analysis, SBOM generation, secure software architecture redesign, redevelopment or remediation of legacy code, technical documentation for conformity assessment, and ongoing vulnerability management. Read our full CRA service overview.

For a single instrument with moderate software complexity, engagements typically run 9 to 18 months from kickoff to a fully compliant, conformity-assessed product. Multi-product portfolios can be sequenced in parallel. The earlier you start, the more flexibility you have on scope and approach.

Yes. The audit consists of a 30-minute discovery call plus a written gap analysis delivered within 5 working days. There is no commitment, no SDR follow-up sequence, and no obligation to engage further. We do this because it is genuinely the best way for both sides to assess fit. Book your free audit here.