IN SHORT
The CRA covers products with digital elements — software or hardware, including their remote data processing solutions — that are made available on the EU market and whose intended purpose or reasonably foreseeable use includes a data connection to a device or network. “Made available on the market” means supplied in the course of a commercial activity, whether paid or free of charge. Products already governed by certain sectoral EU rules (medical devices, in vitro diagnostics, vehicle type-approval, certified aviation products, marine equipment), identical spare parts, and products developed exclusively for national security or defence are excluded. Free and open-source software is covered only when it is supplied in the course of a commercial activity.
Step 1 — Is it a “product with digital elements”?
What the text requires
The Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network Article 2(1)
.
Three definitions in Article 3 do most of the work:
- Product with digital elements: a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately (Article 3, point (1)).
- Remote data processing: data processing at a distance, for which the software is designed and developed by or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions (Article 3, point (2)).
- Data connection: the connection may be logical (through a software interface) or physical (wires, radio, optical…), and direct or indirect — as part of a larger system that is itself connectable (Article 3, point (8), Article 3, point (9), Article 3, point (10)).
The connection test refers to both the intended purpose and the reasonably foreseeable use, which is defined separately from the intended purpose (Article 3, point (23), Article 3, point (24)).
Cloud back-ends and apps
Our interpretation
The recitals explain that a cloud or server function is part of the product only when it meets the definition of remote data processing: processing or storage at a distance falls within the scope of this Regulation only in so far as it is necessary for a product with digital elements to perform its functions Recital 11
. They give the example of cloud functions that let users control a smart home device at a distance, which fall within scope, and of websites that do not support the functionality of a product, or cloud services developed outside the responsibility of the product manufacturer, which do not (Recital 12). Stand-alone cloud services such as SaaS are addressed by the NIS2 Directive according to the same recital — but that does not mean every software offered “as a service” is outside the CRA. See our CRA and SaaS guide.
Step 2 — Is it “made available on the market”?
What the text requires
“Making available on the market” means the supply of a product for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge Article 3, point (22)
. “Placing on the market” is the first making available on the Union market (Article 3, point (21)).
Free products are therefore not automatically outside the CRA: what matters is whether the supply is part of a commercial activity. The recitals give indicators of a commercial activity — charging a price, charging for technical support beyond cost recovery, an intention to monetise (for example through a platform that monetises other services), requiring the processing of personal data for reasons other than security, compatibility or interoperability, or accepting donations exceeding the costs of the product (Recital 15). Accepting donations without the intention of making a profit is not, on its own, a commercial activity (Recital 15). Products developed by a public administration exclusively for its own use are not made available on the market (Recital 16).
Free and open-source software
Free and open-source software is defined in Article 3 (Article 3, point (48)). The recitals explain how the commercial-activity test applies to it:
- only open-source software made available on the market — supplied in the course of a commercial activity — falls within the Regulation (Recital 18);
the provision of products with digital elements qualifying as free and open-source software that are not monetised by their manufacturers should not be considered to be a commercial activity Recital 18
;- receiving financial support or contributions from manufacturers, or publishing regular releases, does not in itself make the activity commercial (Recital 18);
- merely hosting software on open repositories or package managers is not, in itself, making it available on the market (Recital 20).
A separate, lighter regime applies to open-source software stewards (Article 3, point (14), Article 24). See our open-source guide.
Step 3 — Is it excluded?
| Exclusion | Provision |
|---|---|
| Products to which the EU rules on medical devices (Regulation (EU) 2017/745), in vitro diagnostic medical devices (Regulation (EU) 2017/746) or motor vehicle type-approval (Regulation (EU) 2019/2144) apply | Article 2(2) |
| Products certified under the EU civil aviation rules (Regulation (EU) 2018/1139) | Article 2(3) |
| Equipment within the scope of the Marine Equipment Directive (Directive 2014/90/EU) | Article 2(4) |
| Spare parts made available to replace identical components and manufactured to the same specifications | Article 2(6) |
| Products developed or modified exclusively for national security or defence, or specifically designed to process classified information | Article 2(7) |
In addition, the Commission may limit or exclude the application of the CRA, by delegated act, for products covered by other EU rules that address the same risks with an equal or higher level of protection (Article 2(5)). No information has to be supplied if its disclosure would be contrary to Member States’ essential national security, public security or defence interests (Article 2(8)).
Our interpretation
The exclusions in Article 2(2) to (4) are tied to the specific sectoral act. A product that is close to one of those sectors but is not actually covered by the act — for instance a wellness wearable to which the medical devices rules do not apply — is not excluded on that basis. Annex III, for example, lists among important products personal wearables with a health monitoring purpose to which Regulations (EU) 2017/745 and 2017/746 do not apply (Annex III, Part I, point 19).
Step 4 — Does it belong to a special category?
Being in scope is the first question; the second is how conformity must be demonstrated. Products with the core functionality of a category listed in Annex III are “important products” (classes I and II), and products in Annex IV are “critical products”; both are subject to stricter conformity assessment (Article 7(1), Article 8(1)). Integrating an important product as a component does not in itself make the final product subject to those stricter procedures (Article 7(1)). The details are in our conformity assessment guide.
Uncertain / awaiting guidance
Several boundaries depend on facts and on how authorities will apply the text: when a back-end function is “necessary” for the product to perform one of its functions; when an open-source project’s activity becomes monetisation; when donations exceed costs. The Commission can also adopt delegated acts under Article 2(5). Until official guidance or case practice settles these questions, document your reasoning for each product and keep it under review.
Fictional example — Northwind Labs
Northwind Labs (fictional) sells a smart door lock, offers a free companion app, and runs a back-end API without which the app cannot unlock the door remotely. It also publishes a small configuration library on a public repository, free of charge, without monetising it. Northwind would treat the lock, the app and the remote-unlock back-end as one product with digital elements and its remote data processing solution. The library, as long as it is not monetised, is not made available on the market on that basis alone — but if Northwind integrates it into the lock, it becomes part of the lock and is covered as such.
What to do next
Good practice (recommendation, not a legal requirement)
For each product line, write down — with references — the answers to the four steps above: definition, commercial supply, exclusions, and category. Keep that record with your technical documentation and revisit it when the product, its intended purpose or its business model changes.