Does the CRA Apply to Software, SaaS & Cloud?

Key definitions for software

Art. 3(1)

Definition: software is explicitly a "product with digital elements"

Art. 3(24)

"Placing on the market" — the trigger for CRA obligations

15 min

Time to generate the 8-document dossier for in-scope software

How to determine if your software is in scope

Determine if your software is "placed on the market"

Article 3(24): is the software made available for the first time on the EU market? If it is downloaded, installed, deployed on-premise, or runs on the user's device — yes, it is placed on the market.

Check the SaaS boundary

If your product is delivered entirely as a remote service — the user accesses functionality via a browser or API with no software running locally — it is generally not 'placed on the market'. However, if the SaaS product includes a desktop client, mobile app, agent, or plugin that runs on the user's device, that client component is a product with digital elements.

Assess "remote data processing solutions"

Article 3(1) includes 'remote data processing solutions' as part of the product if they are designed by or under the responsibility of the manufacturer and the product cannot perform one of its functions without them. A cloud backend essential to the product's operation is part of the product.

Classify the software

Run CRACheck's Product Classifier. Software categories in Annex III Class I include browsers (point 2), password managers (point 3), VPNs (point 5), operating systems (point 11). Class II includes firewalls (point 2) and intrusion detection systems (point 2).

Generate the Art. 31 dossier

For in-scope software, CRACheck produces the 8-document technical dossier including system architecture description, vulnerability handling processes, SBOM reference, and all Annex VII elements.

Common software scope mistakes

❌

SAAS MISUNDERSTANDING

Assuming all SaaS is outside the CRA

If your SaaS product includes any client-side component — a desktop app, mobile app, browser plugin, or agent — that component is a product with digital elements under Article 3(1) of Regulation (EU) 2024/2847. Only products delivered entirely as a remote service with zero local execution are outside scope.

❌

VERSION OVERSIGHT

Treating software updates as separate products

Article 3(1) refers to the product and its versions. Security updates are part of the manufacturer's vulnerability handling obligations under Annex I Part II and Article 13(8). Each version does not require a new dossier, but the technical documentation must be 'continuously updated' per Article 31(2).

❌

COMPONENT BLIND SPOT

Ignoring SDKs and libraries placed on the market separately

Article 3(1) explicitly includes "software or hardware components being placed on the market separately". If you publish a library, SDK, or API client that third parties integrate into their products, that component is an independent product with digital elements under the CRA.

8 CRA documents for software products

CRACheck generates the complete Art. 31 + Annex VII dossier adapted for software products.

Product Classifier

Classification of your software product against Annex III and Annex IV categories.

Technical Documentation

Art. 31 + Annex VII dossier with software-specific fields: system architecture, software components, dependency map, update distribution mechanism.

Risk Assessment

Cybersecurity risk assessment per Art. 13(2)–(3) for software: vulnerability surface, data handling, authentication, update integrity.

User Information

Annex II: vulnerability reporting contact, support period, commissioning instructions, secure removal/decommissioning.

Declaration of Conformity

Art. 28 + Annex V.

CVD Policy

Coordinated vulnerability disclosure policy per Annex I Part II point (5).

Notification Template

Art. 14 three-stage notification for software vulnerabilities. Art. 14(2): early warning within 24h, notification within 72h, final report within 14 days.

Obligations Calendar

Key dates for your software product lifecycle.

See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.

Generated in your browser. No data leaves your device.

Law firm scope analysis vs CRACheck

🧾 LAW FIRM SCOPE ANALYSIS FOR SOFTWARE

€5,000–€12,000

Written opinion on CRA applicability to SaaS/software. 3–6 weeks. Multiple rounds of clarification. No documentation output.

✓ CRACHECK

€149

Product Classifier determines scope. 8-document dossier generated if in scope. 15–25 minutes. 100% browser-side. One-time payment.

Two layers of compliance

● LAYER 1

Documentation for in-scope software — CRACheck does this

For software products placed on the EU market, CRACheck generates the complete Art. 31 + Annex VII dossier: system architecture, development and production processes, cybersecurity risk assessment, user information, declaration of conformity, CVD policy, and notification template. Adapted to software-specific requirements.

∅ LAYER 2

Scope determination for boundary cases — Your responsibility

CRACheck's Product Classifier provides a structured scope analysis based on Art. 2 and Art. 3 definitions. For products at the SaaS/product boundary — hybrid models with both cloud and client components — the classification may require legal interpretation beyond what any automated tool provides. Consult specialised counsel for binding opinions on boundary cases.

If it is software and it is placed on the market, start with CRACheck. If the scope is genuinely uncertain, add legal counsel.

Enforcement regime

⚖️

CRA: Annex I cybersecurity non-compliance

€15M / 2.5%

Art. 64(2) of Regulation (EU) 2024/2847.

⚖️

CRA: Documentation and conformity assessment failures

€10M / 2%

Art. 64(3) of Regulation (EU) 2024/2847.

⚖️

CRA: Misleading information to authorities

€5M / 1%

Art. 64(4) of Regulation (EU) 2024/2847.

Alternatives compared

Criterion	Law firm	In-house legal	Industry peer advice	CRACheck
Scope analysis	Written opinion	Manual, time-consuming	Anecdotal	Automated classifier per Art. 2 + 3
Documentation	Separate engagement	DIY	None	8 PDFs per Art. 31 + Annex VII
Price	€5,000–€12,000	Internal hours	Free	€149 per product
Turnaround	3–6 weeks	Weeks	N/A	15–25 minutes

Software publisher with multiple products? SDKs, apps, and plugins each count separately.

Every software product placed on the EU market separately needs its own dossier. Volume pricing: €99/product (pack 10), €79/product (pack 30).

Request Volume Pricing

Commercial enquiries via hello@solidwaretools.com

What CRACheck guarantees and what it does not

CRACheck generates a structured document set according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness, and truthfulness of that information is your responsibility as the manufacturer.

We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct. We do not guarantee that a specific document will be accepted by a market surveillance authority in a particular case.

CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions — CRA and software

Is a mobile app covered by the CRA?

If the mobile app is placed on the EU market — downloaded by users from an app store — it is a product with digital elements under Article 3(1) of Regulation (EU) 2024/2847. The CRA applies, and Art. 31 technical documentation is required.

Our software runs entirely in the cloud. Is it a 'product with digital elements'?

If the user accesses functionality exclusively through a web browser or API with no software component installed locally, the product is generally outside the scope of Article 2(1) of Regulation (EU) 2024/2847 because it is not "placed on the market". However, Directive (EU) 2022/2555 (NIS2) may apply to the service provider.

We provide both a cloud platform and a desktop agent. Which is covered?

The desktop agent is a product with digital elements under Article 3(1) of Regulation (EU) 2024/2847. The cloud platform, to the extent it constitutes a 'remote data processing solution' essential to the agent's function, is part of that product per Art. 3(1). CRA documentation covers the product as a whole — agent plus essential cloud components.

Does the CRA apply to APIs sold as a product?

If you distribute an API client library or SDK that is installed on the customer's systems, it is a software component placed on the market separately under Article 3(1). If the API is accessed purely remotely with no client-side code, the analysis is the same as for SaaS.

What about firmware updates delivered over-the-air (OTA)?

Firmware updates are part of the manufacturer's vulnerability handling obligations under Annex I Part II and Article 13(8) of Regulation (EU) 2024/2847. The OTA update mechanism must be described in the technical documentation per Annex VII point 2(b) as part of the 'technical solutions chosen for the secure distribution of updates'.

Is this a subscription?

No. One-time payment. The licence includes a 30-day editing window and 10 regenerations. The downloaded PDF is yours permanently.

Can I request a refund?

Under Article 16(m) of Directive (EU) 2011/83, by activating the licence you give express consent for the immediate generation of digital content, waiving the 14-day withdrawal right. Refunds are accepted only for reproducible technical defects.

What if the regulation changes?

If the regulation is amended during the validity of your licence, you can regenerate the document with the updated version of the generator at no additional cost.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act — full text

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.