Is my product in scope?

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

A quick screening aid, not a legal opinion. Three questions: whether your product counts, whether you're selling into the EU, and whether it's in a stricter product tier.

1. Does your product include digital elements: software or hardware that processes or transmits data? Yes No

3. Which of these best describes a function of your product?

This screening aid doesn't check the regulation's own exemptions. If the answer matters for a real decision, read the regulation itselfbefore relying on it.

Want to know when something changes? Get the regulatory changelog by email