The Cyber Resilience Act and SaaS: when is a cloud service covered?

IN SHORT

The CRA regulates products with digital elements, not services as such. A cloud or SaaS component is covered only when it is the remote data processing solution of a product: processing at a distance whose software is designed and developed by or under the responsibility of the manufacturer, and without which the product could not perform one of its functions (Article 3, point (2)). A stand-alone SaaS offering that is not the remote data processing of a product is, according to recital 12, a matter for Directive (EU) 2022/2555 (NIS2) rather than the CRA. Neither "every SaaS is covered" nor "SaaS is always outside the CRA" is a correct summary — the definition decides.

The definitions

What the text requires

A product with digital elements is a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately Article 3, point (1).

Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under its responsibility, and the absence of which would prevent the product with digital elements from performing one of its functions Article 3, point (2).

The Regulation applies to products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Article 2(1)).

Three cumulative elements therefore matter for a cloud component:

there is a product with digital elements (hardware or software) made available on the market;
the remote processing is designed and developed by or under the responsibility of that product's manufacturer;
without it, the product could not perform one of its functions.

What the recitals say

Recital 11 explains the purpose and the limit of the approach. Products must be secured in their entirety, irrespective of whether data is processed or stored locally on the user's device or remotely by the manufacturer Recital 11; but processing or storage at a distance falls within the scope of this Regulation only in so far as it is necessary for a product with digital elements to perform its functions Recital 11. The recital gives an example: a mobile application that requires access to an application programming interface or a database provided by a service developed by the manufacturer — in that case the service falls within scope as a remote data processing solution (Recital 11).

Recital 12 then draws the line for cloud solutions:

Cloud solutions constitute remote data processing solutions within the meaning of this Regulation only if they meet the definition laid down in this Regulation. Recital 12
Cloud-enabled functionalities provided by a manufacturer of smart home devices that let users control the device at a distance fall within scope.
Websites that do not support the functionality of a product with digital elements, and cloud services designed and developed outside the responsibility of the product's manufacturer, do not fall within scope.
Directive (EU) 2022/2555 applies to cloud computing services and cloud service models such as SaaS, PaaS and IaaS (Recital 12).

Recital 11 also limits what the CRA requires of the remote side: the requirements for remote data processing solutions do not entail measures to manage the risks posed to the security of a manufacturer's network and information systems as a whole (Recital 11).

How NIS2 fits in

The CRA itself points to NIS2 for cloud services (Recital 12). NIS2 is a different kind of instrument: it lays down cybersecurity risk-management measures and reporting obligations for entities of the types listed in its Annexes I and II (Directive (EU) 2022/2555, Article 1(2)(b)), rather than requirements for products placed on the market. Recital 12 of the CRA adds that cloud computing service providers qualifying as medium-sized enterprises, or exceeding those ceilings, fall within the scope of NIS2 (Recital 12).

Our interpretation

In our reading, the two regimes can apply to the same organisation for different things. A company that sells a connected device with a companion cloud backend may be a manufacturer under the CRA for the device and its backend (as remote data processing), and, depending on its sector, size and national transposition, an entity under NIS2 for the network and information systems it uses to provide services. The CRA does not replace NIS2, and NIS2 does not replace the CRA.

Grey areas

Uncertain / awaiting guidance

The text leaves several points to be settled by guidance or practice:

How to treat a SaaS product that also ships downloadable software (for example a desktop or mobile client) — the client is a software product; the question is which backend functions are "necessary" for the client to perform its functions.
Back-ends developed by a third party but operated under contract for the manufacturer ("under the responsibility of the manufacturer").
Features that are optional or degrade gracefully when the cloud is unavailable.

The Commission must address the scope of the Regulation, with a particular focus on remote data processing solutions, if it provides guidance under Article 26 (Article 26(2), first subparagraph, point (a)). We have not yet verified whether such guidance has been published; check it before relying on this page.

Fictional examples

Fictional example — Three products, three answers

LumaHome (fictional) sells smart thermostats. Its own cloud service lets users change the temperature from their phone. That service is designed and developed by LumaHome and the remote-control function cannot work without it: following recital 12, it is a remote data processing solution of the thermostat and is covered with it.

LedgerLeaf (fictional) offers a browser-based accounting service. Customers do not install any product; there is no hardware or software product made available to which the service is the remote processing. On the CRA's own reading in recital 12, this is a cloud service for which NIS2, not the CRA, is the relevant framework — subject to NIS2's own scope criteria.

FieldNote (fictional) sells a downloadable note-taking app whose synchronisation runs on FieldNote's own servers. The app is a software product made available on the market. Whether the synchronisation backend is its remote data processing depends on whether the app's functions are prevented without it — a case-by-case analysis to document.

Good practice (recommendation, not a legal requirement)

For each cloud component, write down (1) which product it serves, (2) who designed and developed it, and (3) which function of the product stops working without it. Keep this analysis with the technical documentation. If the component is in scope, include it in the cybersecurity risk assessment and vulnerability handling of the product. This is a practical method, not a legal requirement.

What to do next

Start from the definitions in Article 3 and recitals 11 and 12, then map each of your cloud services to the products they support.