The CRA scope determination and product classification is retained as a standalone Module 9 artefact. The artefact documents the system’s delivery model, the reasoning for CRA applicability (or non-applicability), the product classification (default, important, critical), the CRA conformity assessment route, and the deemed compliance analysis.

If the CRA applies, the artefact also documents the coordination plan between the CRA conformity assessment and the AI Act conformity assessment. If the CRA does not apply, the artefact documents the reasoning for exclusion, ensuring that the determination can be defended if challenged.

The artefact is reviewed whenever the system’s delivery model changes or when the Commission issues guidance that affects the scope determination. If the system is not a product with digital elements, the artefact documents the non-applicability determination.

Key outputs

• CRA scope determination and product classification document
• Deemed compliance analysis (covered and uncovered threat categories)
• Coordination plan for dual conformity assessment (where applicable)
• Module 9 AISDP evidence