If you sell a premium WordPress plugin, a theme or a Shopify app to customers in the EU, the Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") is very likely about you. It does not matter that your product is small, that you are a team of two, or that you sell through a marketplace. This guide explains when you count as a manufacturer, how freemium and marketplaces fit in, and the one place where Shopify apps differ from WordPress plugins.
Why a plugin is a "product"
The CRA covers software products that connect to a device or network (Art. 2(1)). A product with digital elements is "a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately" (Art. 3(1)). A plugin is exactly that: a software component, sold separately, that runs inside the customer's website and talks to the network.
The Commission's guidance of 27 July 2026 puts it plainly: software that executes on the user's side - a downloaded app, a browser extension, a locally installed client - is a product with digital elements. A WordPress plugin installed on the customer's server fits that description.
Are you the manufacturer?
The manufacturer is whoever develops a product, or has it developed, "and markets them under its name or trademark" (Art. 3(13)). If your name or brand is on the plugin listing and in the plugin header, that is you - even if a freelancer wrote part of the code.
A marketplace that lists your product does not take this role from you. Distributors make products available "without affecting its properties" (Art. 3(17)) and have their own, lighter duties. The manufacturer's duties stay with the one whose name is on the product.
Free, freemium, paid: where the line is
Supply counts as commercial "whether in return for payment or free of charge" (Art. 3(22)). For free and open-source software, the test is monetisation (Recital 18). The Commission's examples say that a free app earning money from advertising, commissions or subscriptions is commercial.
| Your model | Under the CRA? |
|---|---|
| Premium plugin or theme sold on your site or a marketplace | Yes |
| Free plugin on WordPress.org, plus a paid "pro" version | Yes - the pro version, and very likely the free one, because it is how you sell |
| Free plugin, paid support or paid add-ons | Yes - paid support beyond cost recovery is a sign of monetisation (Recital 18) |
| Free plugin that collects user data for advertising | Yes (Recital 18) |
| Hobby plugin, free, GPL, donations only, nothing gated | No |
| Custom plugin built for one client, not sold to others | Depends - check whether it is "made available on the market"; scope check |
Open-source licensing does not help on its own: most WordPress plugins are GPL, and the CRA looks at how you earn money, not at the licence. More in CRA and open source.
Shopify apps: first check whether it is SaaS
Shopify apps are built differently from WordPress plugins. According to Shopify's developer documentation, most apps run on a backend hosted by the developer and appear inside Shopify through app extensions; "extension-only" apps can be hosted on Shopify with no developer backend.
The CRA does not cover SaaS as such: Recital 12 excludes websites that do not support the functionality of a product, and cloud services designed outside the manufacturer's responsibility; SaaS is covered by the NIS2 Directive instead. Our scope check, step 3, explains the test. For Shopify that gives three cases:
| Shopify product | Our reading |
|---|---|
| Theme sold in the Theme Store (Liquid, JavaScript and CSS installed into the merchant's store) | Likely in scope - code you ship and the merchant runs |
| App with extensions (theme app extensions, checkout or admin UI extensions) that run in the store or the merchant's browser | Likely in scope for the shipped code; your backend counts too if the extensions cannot work without it (Art. 3(2)) |
| App that is only a web interface on your server, embedded in the Shopify admin, nothing installed | Probably out as SaaS (Recital 12) |
We found no Commission example about Shopify apps (as of October 2026), so treat this as a reading, not a ruling. If you are unsure, prepare as if you are in scope: the reporting duty already applies, and the cost of a vulnerability process is small compared with being caught without one.
What being a manufacturer means in practice
Already now (since 11 September 2026):
- 24-hour reporting. If an actively exploited vulnerability affects your plugin or app, you send an early warning within 24 hours, a notification within 72 hours and a final report later (Art. 14). This also applies to versions released before the CRA (Art. 69(3)). WordPress plugins are a frequent target of mass exploitation, so this is not theoretical. See CRA 24-hour reporting.
From 11 December 2027, for versions you place on the market:
- No known exploitable vulnerabilities at release and a secure default configuration (Annex I, Part I).
- An SBOM of your dependencies - Composer and npm packages, bundled JavaScript libraries, SDKs (Annex I, Part II(1)). See CRA SBOM and technical documentation.
- Due diligence on third-party code you bundle, including free libraries (Art. 13(5)).
- A coordinated vulnerability disclosure policy and a contact address for reports (Annex I, Part II(5) and (6)) - for example a
security.txtfile and a short policy page. - Free security updates, distributed without delay (Annex I, Part II(8)). A licence model where security fixes stop when the annual licence expires needs a hard look: the CRA expects security updates to reach users free of charge during the support period.
- A support period of at least five years, unless the product is expected to be in use for less (Art. 13(8)), with the end date - at least month and year - stated clearly at purchase (Art. 13(19)). Each security update must stay available for at least 10 years after it is issued, or for the rest of the support period if longer (Art. 13(9)).
- Technical documentation, EU declaration of conformity and CE marking. For software, the CE marking can go on the website or in the documentation. Most plugins and apps are in the default category and can use self-assessment.
A checklist for plugin and app sellers
| By when | What |
|---|---|
| Now | Contact address and disclosure policy online; people registered on ENISA's Single Reporting Platform; SBOM for the current version |
| Now | Daily check of your dependencies against known exploited vulnerabilities |
| Q1 2027 | Decide the support period and where you show its end date (product page, licence terms) |
| Q2 2027 | Check how security updates reach users with expired licences |
| Q3-Q4 2027 | Technical documentation, declaration of conformity, CE marking - before 11 December 2027 |
The full sequence is in the CRA timeline.
Not sure where you stand?
Take the free "Does the CRA apply to me and what must I do by December 2027" check: 8 questions, about 3 minutes, result on screen and checklist by e-mail. Take the free check
Earlybell is built for small plugin and app sellers: connect your repository, and we generate the SBOM with every release, check your dependencies daily, draft your 24-hour and 72-hour reports for you to submit, and keep your disclosure policy and security.txt up to date. 49 EUR per product per month.
This article is based on Regulation (EU) 2024/2847 (Cyber Resilience Act), guidance published by the European Commission and Shopify's developer documentation. It is not legal advice. Article numbers refer to that Regulation.