Explanation
What is a product with digital elements?
The regulation applies to products with digital elements, defined as a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately Article 3, point (1)
.
Three points deserve attention:
- Software alone is enough. A mobile app or a desktop application can be a product with digital elements, as can a router or a microcontroller.
- Components count. Software or hardware components placed on the market separately are themselves products with digital elements.
- Remote data processing is part of the product. Remote data processing means data processing at a distance for which the software is designed and developed by or under the responsibility of the manufacturer, and without which the product could not perform one of its functions.
Our interpretation
Cloud functionality is therefore not automatically outside the CRA, nor automatically inside it. Recital 12 explains that cloud solutions are remote data processing solutions only if they meet that definition: the cloud functions a smart home manufacturer provides to control its devices remotely are covered, whereas websites that do not support the functionality of a product, or cloud services designed outside the responsibility of a product manufacturer, are not (Recital 12). The same recital notes that Directive (EU) 2022/2555 (NIS2) applies to cloud computing services such as SaaS. Each service must be analysed against the definition.
The scope condition
What the text requires
The regulation applies to products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Article 2(1)).
"Making available on the market" means supplying a product for distribution or use on the EU market in the course of a commercial activity, whether in return for payment or free of charge (Article 3, point (22)). A product supplied free of charge can therefore still be in scope.
Exclusions
Article 2 excludes several categories:
- products to which the regulations on medical devices, in vitro diagnostic medical devices or vehicle type-approval apply (Article 2(2));
- products certified under the EU aviation safety regulation (Article 2(3));
- marine equipment within the scope of Directive 2014/90/EU (Article 2(4));
- spare parts made available to replace identical components and manufactured to the same specifications (Article 2(6));
- products developed or modified exclusively for national security or defence purposes, or specifically designed to process classified information (Article 2(7)).
The application of the regulation can also be limited or excluded by delegated act for products covered by sectoral rules that achieve the same or a higher level of protection (Article 2(5)).
Free and open-source software
Free and open-source software is not exempt as such. Recital 18 explains that only free and open-source software made available on the market — supplied in the course of a commercial activity — falls within scope, and that providing free and open-source software that is not monetised by its manufacturer should not be considered a commercial activity.
The regulation also creates a specific role, the open-source software steward: a legal person, other than a manufacturer, that systematically provides sustained support for the development of specific free and open-source products intended for commercial activities (Article 3, point (14)). Stewards have lighter obligations: a documented cybersecurity policy and cooperation with authorities (Article 24(1), Article 24(2)), and parts of the reporting obligations to the extent set out in Article 24(3).
Uncertain / awaiting guidance
Where exactly the line between commercial and non-commercial supply falls for a given open-source project depends on facts the recitals only illustrate. The regulation asks the Commission to publish guidance on this point (Article 26(2), first subparagraph, point (a)); check for it before drawing conclusions on a borderline case.
Economic operators and their roles
An economic operator is the manufacturer, the authorised representative, the importer, the distributor or another person subject to obligations under the regulation (Article 3, point (12)).
| Role | Definition | Core obligations |
|---|---|---|
| Manufacturer | Develops or manufactures products, or has them designed, developed or manufactured, and markets them under its name or trademark, for payment, monetisation or free of charge (Article 3, point (13)) | Articles 13 and 14: design to Annex I, risk assessment, vulnerability handling, documentation, conformity assessment, reporting |
| Authorised representative | Established in the EU with a written mandate from the manufacturer (Article 3, point (15)) | Tasks in the mandate; cannot take over the design obligations (Article 18(2)) |
| Importer | Established in the EU, places on the market a product bearing the name or trademark of a person established outside the EU (Article 3, point (16)) | Checks before placing on the market (Article 19(2)), contact details, corrective action, records |
| Distributor | Makes a product available without affecting its properties, other than the manufacturer or importer (Article 3, point (17)) | Due care (Article 20(1)) and checks before making available (Article 20(2)) |
What the text requires
An importer or distributor is considered a manufacturer and is subject to Articles 13 and 14 where it places a product on the market under its own name or trademark, or carries out a substantial modification of a product already placed on the market (Article 21). Any other person who substantially modifies a product and makes it available is also considered a manufacturer, for the part affected by the modification or, if the modification affects the cybersecurity of the product as a whole, for the entire product (Article 22(1), Article 22(2)).
A substantial modification is a change after placing on the market that affects compliance with Part I of Annex I or modifies the intended purpose for which the product was assessed (Article 3, point (30)).
A first look at product classes
Some products receive stricter conformity assessment because of their core functionality: important products listed in Annex III, in class I or class II (Article 7(1)), and critical products listed in Annex IV (Article 8). The classification depends on the core functionality: shall not in itself render the product in which it is integrated subject to the conformity assessment procedures Article 7(1)
— integrating, say, a password manager into a larger product does not by itself subject the host product to those stricter procedures. Lesson 5 explains the consequences.
Practical case
Fictional example — Nordlicht Home and its partners
Nordlicht Home, a fictional company in Austria, designs a connected thermostat, a mobile app and a cloud service that lets users change the temperature remotely. Without the cloud service, remote control — one of the product's functions — does not work.
- Nordlicht is the manufacturer of the thermostat and the app. The cloud service is designed by Nordlicht and needed for a product function: it is a remote data processing solution and part of the product.
- Nordlicht's public marketing website does not support any product function: it is not part of the product.
- Retailer "ShopNord" sells the thermostat unchanged: it is a distributor and must check the CE marking and the required information before selling.
- ShopNord also buys a security camera from a manufacturer in a third country and sells it under its own "ShopNord Secure" brand. For that camera, ShopNord is considered the manufacturer and is subject to Articles 13 and 14.
Exercise
EXERCISE — WHO IS WHO?
For each situation, identify the role of the company and the main provision.
- A company established in Belgium places on the EU market routers bearing the trademark of a manufacturer established in Taiwan.
- An online shop resells those routers unchanged.
- An integrator replaces the firmware of a router already on the market with its own firmware that adds remote administration functions, then sells the routers.
- A non-profit foundation systematically supports the development of an open-source library intended for commercial activities, but does not market it.
Show a suggested answer
- Importer — Article 3, point (16); obligations in Article 19.
- Distributor — Article 3, point (17); obligations in Article 20.
- Very likely a substantial modification (Article 3, point (30)): the person making it and making the product available is considered a manufacturer (Article 22, or Article 21 if it is an importer or distributor). This must be confirmed against the facts.
- Potentially an open-source software steward (Article 3, point (14)), with the obligations of Article 24 — if the conditions of the definition are met.
Key takeaways
KEY TAKEAWAYS
- Products with digital elements include software, hardware, components placed on the market separately, and the manufacturer's remote data processing solutions.
- Scope requires making available on the market (commercial activity, paid or free) and an intended or reasonably foreseeable data connection.
- Article 2 excludes specific sectors, identical spare parts and national security or defence products.
- Free and open-source software is covered only when made available in the course of a commercial activity; stewards have a lighter regime.
- Importers and distributors become manufacturers when they use their own brand or make a substantial modification.