Does the Cyber Resilience Act cover software and SaaS?

The short answer: software you supply to customers in the EU is covered in the same way as hardware, whether you charge for it or not. A cloud service on its own is not — unless it is the part of a product that the product needs in order to work. The rest of this page is where that line falls, and how to tell which side you are on.

Software is a product

The Act does not treat software as a lesser kind of product.

A product with digital elements is a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately.[Art. 3(1)]

What brings a product in is a connection, and the test is wide. The Regulation applies to a product with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection — logical or physical — to a device or network. This is the first scoping question, and it is the only test Article 2(1) sets: nothing in it turns on how big the company is or where it is based.[Art. 2(1)] A desktop application that talks to a server, a mobile app, the firmware in a device and a library you sell for other people to build in all pass it. So does software that only reaches a network through something else. A connection counts as indirect when the product does not reach a device or network by itself, but does so as part of a larger system that is directly connectable. That test settles how a product is connected, not who owes what. A component is a product in its own right when it is placed on the market separately; a part a manufacturer builds into its own product and never supplies on its own is covered through the product around it instead. And building in a component that belongs to one of the important or critical categories does not by itself put the surrounding product into that category.[Art. 3(10); Art. 3(1); Art. 7(1)]

Free still counts

Charging nothing does not take a product out. What matters is whether you supply it in the course of a commercial activity. Making a product available on the market means supplying it for distribution or use on the Union market in the course of a commercial activity, whether it is paid for or free, and placing on the market is the first such supply. Because the test is supply onto the Union market, a seller established outside the EU is caught in the same way as one inside it, and the size of the company makes no difference. The Regulation does not define "commercial activity" itself; the examples usually quoted for it come from the recitals, which guide interpretation rather than bind.[Art. 3(21), Art. 3(22); recitals for the commercial-activity examples] A free app that makes its money from advertising, from a paid tier or from the hardware it controls is supplied commercially. Open source is the one case that turns on this test in practice, and it has a guide of its own.

Where SaaS stops and a product starts

This is the question software companies ask most, and the Act answers it through one definition. Remote data processing means processing at a distance for which the software is designed and developed by the manufacturer, or under the manufacturer's responsibility, and without which the product could not perform one of its functions. A pure cloud service that is not part of a product in this sense is not itself covered — that carve-out is stated in the recitals rather than in the definition, and it turns on the responsibility limb: a cloud service designed and developed outside a product manufacturer's responsibility is outside the Regulation.[Art. 3(2); recital 12 for the cloud carve-out]

Put plainly:

• The cloud side of a product is covered as part of that product. If your device or your app cannot do what it is sold to do without your back-end, the back-end is the product's remote data processing, and the product's duties reach it.
• A service that stands on its own is outside this Act. A web application used only through a browser, with nothing supplied to the customer to install or run, is a service rather than a product with digital elements — the carve-out the recitals make, read with the definition above.

The edges are real — an installable agent for a cloud platform, or a web application that ships a desktop client — and the Act expects the European Commission to settle them. The Commission must publish guidance to help economic operators apply the Regulation, and the list of aspects it must address includes the scope of this Regulation, with a particular focus on remote data processing solutions and free and open-source software, and the concept of substantial modification. That guidance is where the borderline cases are meant to be settled; while it is unpublished, the application of those tests at the margin rests on the enacting terms alone and a determination that turns on one of them should say so.[Art. 26(1); Art. 26(2)(a); Art. 26(2)(d)] Until then, a determination at the edge should say that it rests on the definition alone.

A service outside this Act is not outside every law. The one to check is NIS2, which applies to organisations rather than products.

Directive (EU) 2022/2555 (NIS2) sets cybersecurity and incident-reporting obligations for essential and important entities. It applies to organisations, not products, and only to organisations working in the sectors listed in its Annexes I and II that are medium-sized or larger — with a short list of exceptions, such as providers of public electronic communications networks and services, trust service providers and DNS and top-level-domain operators, which are covered whatever their size. The Cyber Resilience Act, by contrast, applies to a product regardless of how small the company that makes it is.[Title; Art. 2(1) and 2(2); Art. 3(1) and 3(2); Art. 23(1)]

Sectors with their own rules

A short list of sectors are carved out because other product law already covers them. The sector carve-outs are a short, closed list. Products to which the medical device, the in-vitro diagnostic or the motor vehicle type-approval Regulations apply are outside the Cyber Resilience Act, and so is equipment within the scope of the marine equipment Directive. Civil aviation works differently and more narrowly: what is outside is a product that has actually been certified under the EU civil aviation Regulation, not aviation equipment as a class, so an uncertified product sold into that sector is fully in scope. Outside as well are products developed or modified exclusively for national security or defence purposes — "exclusively" is the whole of that gate, and it asks what the product was developed or modified for rather than who buys it, so neither a product also sold commercially nor a general-market product whose customers today are all defence ones is carved out — and, on a different test, products specifically designed to process classified information. Any wider limitation or exclusion for products covered by other Union rules needs a Commission delegated act; no other rulebook displaces this one by itself. One such act has now been adopted and it takes out a whole sector — the L-category vehicles of Regulation (EU) No 168/2013 — so the closed list above is no longer the whole of the answer, and that sector exclusion has to be read with it.[Art. 2(2), 2(3), 2(4), 2(5), 2(7)]

Five common cases

These are the patterns, not your answer. A product's own facts — who develops the back-end, how it is supplied, what it is for — can move it from one row to another.

If you want help

Our scope check asks those facts in eight short steps and tells you, free and in about two minutes, whether the Act applies to your product, which duties are yours and the article behind each answer. Where the answer turns on a fact a form cannot settle, it names that fact. It is our engineering reading of the law, not a legal ruling.