Article 11 — General product safety

Cyber Resilience Act (CRA) · Chapter I

By way of derogation from Article 2(1), third subparagraph, point (b), of Regulation (EU) 2023/988, Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of that Regulation shall apply to products with digital elements with respect to aspects and risks or categories of risks that are not covered by this Regulation where those products are not subject to specific safety requirements laid down in other ‘Union harmonisation legislation’ as defined in Article 3, point (27), of Regulation (EU) 2023/988.

In practiceMeroi Security’s note, not part of the regulation

The two regulations divide by risk type. The FAQ explains that the CRA provides cybersecurity requirements while the General Product Safety Regulation provides safety requirements, and that the CRA applies only to products with digital elements whereas the GPSR applies to all consumer products to the extent that there are no specific provisions with the same objective under Union law regulating the safety of the products concerned. A product with digital elements may need to comply with both. Where it poses risks beyond the cybersecurity risks the CRA covers, and no product-specific regulation governs those other risks, the GPSR applies to the safety aspects of them.

Source: Commission services FAQ v1.4 (4 Sep 2026) §2.5.1, §2.5.2

General information. This does not constitute legal advice.