Does the CRA apply to your product?
A few questions on the scope of Regulation (EU) 2024/2847. Nothing you tick is sent anywhere.
The result shows here as you answer.
Guidance, not legal advice. Delegated acts under Art. 2(5) can limit the CRA for products covered by other EU rules.
What decides it
The CRA covers products with digital elements made available on the EU market whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1)). So the check asks whether it can connect, where it’s supplied, what the customer actually gets, and whether one of the exclusions in Article 2 applies.
Software: where it runs decides it
Software counts when it’s supplied to the user and runs on the user’s side. Software that runs remotely and is merely accessed doesn’t count on that basis alone (Commission guidance, 27 July 2026, points 20–21; the guidance isn’t binding).
Outside the CRA, as long as it doesn’t support a product
- a web application used only through a browser, progressive web apps included (Example 5)
- a website that only presents information (Example 6)
- a cloud service designed and developed outside a manufacturer’s responsibility (recital 12)
Inside the CRA, when supplied in the course of a commercial activity
- a mobile app from an app store (Example 3)
- a desktop app, also one built with web technologies and packaged for local use (Example 4)
- a browser extension (point 20)
- anything else installed on the customer’s systems, such as an agent or an on-premises collector (point 20)
- a component placed on the market separately, such as an SDK or a library (Article 3(1))
Charging nothing doesn’t change this: making available covers supply “whether in return for payment or free of charge” (Article 3(22)).
When a cloud service is part of the product
A service at a distance belongs to the product when both of these hold: the product couldn’t perform one of its functions without it, and you designed and developed its software or had it built to your specifications (Article 3(2); guidance, points 188–195). Where it’s hosted makes no difference (points 187 and 196).
A third party’s general SaaS isn’t part of your product, even if the product needs it. You treat it like a component: name it in the technical documentation, assess the risk and check the supplier (points 200–204). Systems behind the service that the product doesn’t talk to directly aren’t part of it, but they belong in the risk assessment (points 205–206).
If you’re out of scope
Other rules can still apply. Medium-sized and larger cloud providers can fall under NIS2, and in Norway digitalsikkerhetsloven applies to cloud services above a certain size. GDPR applies as before. Larger customers may still ask about the CRA in their security questionnaires, and a manufacturer that builds your service into its product has to check you.
If you’re in scope
The reporting duties in Article 14 have applied since 11 September 2026, also to products placed on the market before then. The rest of the CRA applies to products placed on the market from 11 December 2027. The CRA isn’t yet part of the EEA Agreement, so a product sold only in Norway isn’t covered yet.
Next, check the product’s class, which decides how you show conformity. The CRA guide covers the rest. Keep the technical documentation, the declaration of conformity and the user information for at least 10 years after the product is placed on the market, or for the support period if that’s longer, and each security update for at least 10 years after it’s issued (Article 13(9), (13) and (18)).
What the check can’t do
It looks at one product at a time and doesn’t replace legal advice. Delegated acts under Article 2(5) can limit the CRA for products covered by other EU rules. A product can also be in scope in one form and out in another, such as a web app with a separate desktop client: check each thing you supply.
