The Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") covers far more products than most small software companies expect - and fewer than some vendors of compliance tools claim. Its reporting duty already applies since 11 September 2026, the rest from 11 December 2027 (Art. 71(2)). So the first question is simple: is your product in or out?
Step 1: Is it a "product with digital elements"?
The CRA applies to "products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network" (Art. 2(1)).
A product with digital elements is "a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately" (Art. 3(1)). Three things follow:
- Software alone is enough. You do not need to make hardware. A desktop app, a mobile app or a WordPress plugin is a product.
- Components count. An SDK or a library that you sell for other companies to build into their products is a product in its own right.
- Connection is almost always there. Internet, local network, Bluetooth, USB, an API call - any direct or indirect data connection is enough. Truly offline products are rare.
Step 2: Is it "made available in the course of a commercial activity"?
Making available on the market means "the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge" (Art. 3(22)).
So free is not automatically out. A free app that is part of your business still counts. For free and open-source software, the recitals give the test: software that is "not monetised by their manufacturers" is outside; charging a price for the product, charging for technical support beyond cost recovery, or requiring the processing of personal data for reasons other than security are signs of monetisation (Recital 18). Accepting donations without the intention of making a profit is not a commercial activity (Recital 18).
Step 3: Pure SaaS - usually out, with one catch
Recital 12 says that websites which do not support the functionality of a product with digital elements, and cloud services designed and developed outside the responsibility of a product's manufacturer, are not covered. SaaS as such falls under the NIS2 Directive (Directive (EU) 2022/2555), not the CRA (Recital 12). The Commission's guidance of 27 July 2026 confirms that software executed remotely for user access generally falls outside the scope.
The catch: remote data processing. Your backend is part of your product if it is "designed and developed by the manufacturer, or under the responsibility of the manufacturer", and its absence "would prevent the product with digital elements from performing one of its functions" (Art. 3(2)). Recital 12 gives the example of a cloud function that lets users control a smart home device at a distance. If you ship an app or device that depends on your server, the server is in scope together with the product.
Step 4: Is your sector excluded?
The CRA does not apply to products covered by the EU rules on medical devices (Regulation (EU) 2017/745), in vitro diagnostic devices (2017/746) and motor vehicle type-approval (2019/2144) (Art. 2(2)), to products certified under the civil aviation rules (Regulation (EU) 2018/1139, Art. 2(3)), or to marine equipment (Directive 2014/90/EU, Art. 2(4)). Also out: identical spare parts (Art. 2(6)) and products developed or modified exclusively for national security or defence (Art. 2(7)).
Step 5: Are you the manufacturer?
The duties fall mainly on the manufacturer: whoever develops or manufactures the product, or has it developed, "and markets them under its name or trademark" (Art. 3(13)). If you build and sell under your own brand, that is you.
Importers and distributors have their own, lighter duties (Art. 19 and 20). But if they put a product on the market under their own name or trademark, or carry out a substantial modification, they become the manufacturer (Art. 21).
Examples: yes, no, it depends
| Product | Covered? | Why |
|---|---|---|
| Paid desktop or mobile app | Yes | Software product, connects to a network, sold commercially (Art. 2(1), 3(1)) |
| Premium WordPress plugin or theme | Yes | Installable code that runs in the customer's system; paid |
| SDK or library sold to other developers | Yes | Component placed on the market separately (Art. 3(1)) |
| Device with firmware (sensor, router, smart plug) | Yes | Hardware product with data connection; its cloud backend too, if needed for a function (Art. 3(2)) |
| Browser-only SaaS, nothing to install | Usually no | Recital 12; falls under NIS2 instead |
| Mobile app that only works with your server | Yes, with the server | Backend is remote data processing (Art. 3(2)) |
| Free open-source library, donations only | No | Not monetised (Recital 18) |
| Open-source project with a paid "pro" version or paid support | Usually yes | Monetisation (Recital 18) |
| Software for a medical device or a car | No | Own EU rules (Art. 2(2)) |
If the answer is yes: what comes next
Since 11 September 2026: report actively exploited vulnerabilities and severe incidents in 24 hours, 72 hours and 14 days or one month (Art. 14). This covers products already on the market, too (Art. 69(3)). Details in our guide to CRA 24-hour reporting.
From 11 December 2027: the essential cybersecurity requirements of Annex I, a support period of at least five years unless the product is expected to be used for less (Art. 13(8)), technical documentation with an SBOM, the EU declaration of conformity and the CE marking. Products placed on the market before that date are covered by these requirements only if they are substantially modified afterwards (Art. 69(2)). See CRA SBOM and technical documentation and the full CRA timeline.
There is no exemption for small companies from these duties. Micro and small companies get relief in a few places - for example they cannot be fined for missing the 24-hour early warning (Art. 64(10)(a)) and may use a simplified technical documentation form (Art. 33(5)). More in CRA fines: what a micro company actually risks.
Not sure about your case?
Edge cases are common: a Shopify app, an app that is half installable and half web, an open-source project with a sponsor. Our free "Does the CRA apply to me and what must I do by December 2027" check asks 8 questions in about 3 minutes and sends you the result and a checklist by e-mail. Take the free check
If the CRA applies to you, Earlybell does the recurring work for you: an SBOM with every release, a daily check of your dependencies, ready-to-send drafts of the 24-hour and 72-hour reports, and an up-to-date disclosure policy and security.txt. 49 EUR per product per month.
This article is based on Regulation (EU) 2024/2847 (Cyber Resilience Act) and on guidance published by the European Commission. It is not legal advice. Article numbers refer to that Regulation.