Automotive CRA scope: are your products actually covered?

TL;DR: The EU Cyber Resilience Act does not exempt automotive suppliers just because finished vehicles are type-approved, according to Finite State, because CRA applicability is decided product by product for items sold separately or outside the factory. That makes portfolio mapping, documentation reuse, and lifecycle vulnerability reporting a regulatory and engineering problem, not a one-time compliance check.

Editorial analysis by NHI Mgmt Group, based on content published by Finite State: “Cyber Resilience Act for Automotive Suppliers: The Car Is Exempt, but What's Inside Isn't”.

Key questions

Q: What breaks when automotive suppliers assume vehicle approval covers every connected product?

A: They miss the product-level scope test.

Q: When should suppliers prioritise CRA mapping over product development work?

A: Before launch, especially for products that can be sold both inside and outside a vehicle.

Q: What signs show that a connected-vehicle product is becoming a compliance risk?

A: The warning signs are incomplete product inventories, reused components with no market-path traceability, outdated security documentation, and support or reporting commitments that differ across channels.

Practitioner guidance

• Map every digital product by market path Create a product inventory that records whether each item is factory-integrated, sold separately, or reused across industries, because CRA applicability depends on placement on the market.
• Separate dual-use components into compliance tracks For modules used both in vehicles and as standalone products, document which obligations attach in each distribution model and preserve the evidence set for both.
• Reuse existing cybersecurity evidence where it is still current Gather design, testing, vulnerability, and secure handling documentation that already exists, then identify where it supports CRA expectations and where it is incomplete or outdated.

Bottom line: The article shows that CRA applicability in automotive depends on product placement, not on whether the company operates in a regulated vehicle programme.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →