The CRA and the CE marking you already have

This page is for the manufacturer who has done this before: you have a technical file, a notified body relationship perhaps, a declaration of conformity, and a CE marking already on the product. The question is what actually changes.

The five carve-outs, exactly

Article 2 does the scoping. It is worth being precise about it, because the exclusions are narrower than the sector names suggest.

Three things about that table matter more than the list itself.

• Aviation is the narrowest. Article 2(3) excludes products that have been certified under Regulation (EU) 2018/1139 — not the aviation sector. A component intended for a certified aircraft but not itself certified, or equipment in the open drone category, is not excluded by the words used.
• The exclusions are per product, not per company. Article 2(2) excludes products to which those acts apply. A manufacturer whose flagship is a medical device is fully in scope for its other connected products.
• “Exclusively” and “same specifications” are doing work. A dual-use product is not exclusively for defence. An improved or merely compatible replacement part is not manufactured to the same specifications as the component it replaces.

Article 2(8) adds a separate protection rather than an exclusion: the obligations in the Regulation do not entail supplying information whose disclosure would be contrary to the essential interests of national security, public security or defence.

And note what is not in Article 2: the Radio Equipment Directive, the EMC and Low Voltage directives, the Machinery Regulation, the General Product Safety Regulation, the toy rules. None of them is excluded. For all of those, the CRA is an additional layer.

The exemption everyone hopes for, and why it is empty

Article 2(5) looks, at first reading, like the provision that saves a regulated industry from doing this twice. It says the application of the CRA to products covered by other Union rules addressing all or some of the same risks “may be limited or excluded” where the limitation is consistent with the overall regulatory framework and the sectoral rules achieve the same or a higher level of protection.

Then it ends: “The Commission is empowered to adopt delegated acts … specifying whether such limitation or exclusion is necessary, the products and rules concerned, as well as the scope of the limitation”.

So it is not a self-executing exemption. It is a power that has to be exercised, product category by product category, in a delegated act. No such delegated act has been adopted as far as the Commission's own published implementation pages show. Until one is, the only sectoral exclusions are the ones in Article 2(2) to (4) and (7).

Radio equipment: already repealed

This is the one overlap that was genuinely resolved, and the resolution is more advanced than most published commentary reflects.

The sequence:

1. Commission Delegated Regulation (EU) 2022/30 activated the cybersecurity requirements in Article 3(3), points (d), (e) and (f), of the Radio Equipment Directive 2014/53/EU for internet-connected radio equipment.
2. Commission Delegated Regulation (EU) 2023/2444 postponed its application from 1 August 2024 to 1 August 2025.
3. Commission Delegated Regulation (EU) 2026/339 of 16 February 2026, published in the Official Journal on 29 April 2026, repeals Delegated Regulation (EU) 2022/30. Its Article 1 reads, in full: “Delegated Regulation (EU) 2022/30 is repealed with effect from 11 December 2027.”

That date is not a coincidence. 11 December 2027 is the day the CRA becomes applicable under Article 71(2). The effect for a radio-equipment manufacturer is a clean handover:

There is no window of genuine double compliance for newly placed radio equipment, and that appears to be deliberate. Market surveillance of units placed on the market during the earlier window continues under the RED — a repeal with future effect does not retrospectively unmake the obligation that applied at the time.

Machinery: two assessments, eleven months apart

The Machinery Regulation (EU) 2023/1230 is not excluded by Article 2, and it contains cybersecurity-adjacent essential health and safety requirements of its own — protection against corruption, and the safety and reliability of control systems. A connected machine is therefore subject to both instruments.

Two points, and the second is the expensive one:

• The dates are staggered. The Machinery Regulation applies from 20 January 2027; the CRA from 11 December 2027. A machine builder meets the machinery requirements roughly eleven months before the CRA lands.
• Conformity assessment does not merge. The Commission's own FAQ states the position plainly: the procedures in the two instruments are of such a nature that assessment under one cannot automatically be treated as sufficient for the other. Two assessments, even though you will produce one declaration.

The CRA's recitals encourage manufacturers to exploit synergies between the two, which is sound engineering advice and not a legal shortcut.

High-risk AI: the deeming runs one way

Article 12 is the CRA's only cross-instrument discharge, and it is worth reading carefully because it is narrower than the summaries suggest. Products in CRA scope that are classified as high-risk AI systems under Article 6 of the AI Act, Regulation (EU) 2024/1689, are deemed to comply with the cybersecurity requirements in Article 15 of the AI Act where three conditions are met cumulatively: the product meets Annex I Part I, the manufacturer's processes meet Annex I Part II, and the achievement of the AI Act's required protection level is demonstrated in the EU declaration of conformity issued under the CRA.

Three consequences:

• It is expressly without prejudice to the accuracy and robustness requirements in the same AI Act article. Only the cybersecurity limb is deemed satisfied.
• Condition (c) is a drafting duty. A CRA declaration that says nothing about the AI Act protection level does not trigger the deeming, however compliant the product is.
• It runs CRA → AI Act only. Nothing in Article 12 makes AI Act conformity discharge a CRA requirement.

Article 12(2) routes the assessment to the AI Act's own procedure and makes AI Act notified bodies competent for CRA Annex I, subject to conditions. Article 12(3) then pulls important and critical products back into CRA conformity assessment in defined cases — if you are in Annex III or Annex IV and also a high-risk AI system, read Article 12(3) itself rather than any summary of it, including ours.

One marking, one declaration

Two provisions do this work, and the second one surprises people.

Article 30(5), second sentence: where the product is subject to other Union harmonisation legislation that also provides for the affixing of the CE marking, the CE marking indicates that the product also fulfils the requirements of that other legislation. One marking, wider meaning.

Article 28(3), in full:

Where a product with digital elements is subject to more than one Union legal act requiring an EU declaration of conformity, a single EU declaration of conformity shall be drawn up in respect of all such Union legal acts. That declaration shall contain the identification of the Union legal acts concerned, including their publication references.

“Shall be drawn up”. The single declaration is not an option offered for convenience — it is the required form. A manufacturer maintaining a separate CRA declaration alongside its existing RED or Machinery declaration for the same product is not complying with Article 28(3). Our guide to the declaration of conformity covers the Annex V contents; the point here is that the document is one document.

Two mechanical details from Article 30 that matter for software products:

• Software has its own marking rule. Article 30(1): for products in the form of software, the CE marking is affixed either to the EU declaration of conformity or on the website accompanying the software product — and if on a website, the relevant section must be easily and directly accessible to consumers.
• The notified body number is not always required. Article 30(4): the CE marking is followed by the notified body's identification number where that body is involved in the conformity assessment procedure based on full quality assurance, module H. See whether you need a notified body at all.

What your existing work is worth

Legally, less than you would like. Article 27 gives three presumption routes, and none of them is “conformity under another product instrument”:

1. Harmonised standards whose references are published in the Official Journal (Article 27(1)) — none published for the CRA yet.
2. Common specifications in implementing acts (Article 27(5)), available only where a standardisation request has failed.
3. A European cybersecurity certification scheme under Regulation (EU) 2019/881 (Article 27(8)), in so far as it covers the Annex I requirements.

The third route has real value if it becomes available. Article 27(9) provides that a European cybersecurity certificate at at least assurance level “substantial” eliminates the obligation to carry out a third-party conformity assessment for the corresponding requirements. The Commission is empowered to specify by delegated act which schemes can be used, and that act has not been adopted — so today this is a route on paper.

Practically, though, your existing work is far from wasted. Your threat model, test reports, secure-development records, supplier assessments and change-control evidence are all reusable as evidence in a CRA technical file. What does not transfer is the conclusion. You cannot point at a RED certificate and treat an Annex I requirement as met.

The transitional provisions nobody quotes

Article 69 has three paragraphs and each one changes something for an existing CE-mark holder. This is the most useful provision on this page and it is almost never cited.

Read 69(3) together with Article 71(2), which applies Article 14 from 11 September 2026, and the position today is this: your existing fleet is already inside the reporting regime, with no CE marking, declaration or Annex I duty in sight. A manufacturer reasoning “the CRA starts in December 2027” is not being cautious; they are already behind. See the reporting deadlines for what that actually requires.