Exclusions (medical devices, vehicles, aviation)

The Cyber Resilience Act (EU) 2024/2847 excludes from its security-by-design obligations certain high-risk sectors, specifically medical devices, vehicles and aviation equipment, which remain regulated under separate, sector-specific frameworks. These exclusions limit the Act's applicability to most other digital products and services.