Definitions: Key Terms in the Cyber Resilience Act

The CRA defines a product with digital elements as any software or hardware product (and its remote data processing solutions) that:

1. Can connect - directly or indirectly - to another device or network
2. Is placed on the EU market (sold to EU customers) after the application date

• Physical hardware devices with embedded software (IoT devices, routers, industrial controllers)
• Standalone software applications (both desktop and mobile)
• Operating systems and firmware
• Software components sold as part of a larger product

Key test: Does the product have any form of network connectivity, even indirect? If yes, it is likely in scope.

Article 3 excludes products already subject to equivalent cybersecurity requirements under other EU regulations:

• Medical devices - Covered by MDR (Medical Device Regulation) and IVDR
• Motor vehicles - Covered by UNECE WP.29 and the EU type-approval framework
• Civil aviation products - Covered by EASA regulations
• Marine equipment - Covered under the Marine Equipment Directive
• Military and national security products - Excluded from EU internal market law entirely

Important: Products that partially overlap with these sectors but are not specifically regulated by sector-specific legislation may still be in scope. For example, a health and fitness tracker that is not classified as a medical device is not excluded from the CRA.

Pure Software as a Service (SaaS) and cloud services are generally not covered by the CRA. The CRA focuses on products placed on the market - i.e., products that are downloaded, installed, or shipped as physical goods.

• Software that is downloaded and installed on a device (mobile apps, desktop applications) is in scope.
• Hardware products that rely on cloud connectivity for their primary function are in scope (the hardware product, not the cloud service itself).
• If a vendor offers both a downloadable product and a cloud-hosted version, the downloadable product is likely in scope.

This distinction is important for software vendors who offer both SaaS and on-premise deployment options.

The CRA distinguishes between three roles in the supply chain:

1. Manufacturers - Companies that design, develop, and produce products, or have them designed/produced and sell them under their own name or trademark. Manufacturers bear the primary compliance obligations.

1. Importers - Companies that bring non-EU products into the EU market. Importers must verify manufacturer compliance and may bear liability if a manufacturer is unreachable.

1. Distributors - Companies that make products available on the EU market without placing them on the market themselves. Distributors have lighter obligations but must verify that products bear proper CE marking.

For global manufacturers with EU customers, the manufacturer obligations apply regardless of where the manufacturer is based.

Commission guidance C(2026) 5252 works through several Article 3 definitions in detail.

Remote data processing under Article 3(2) reduces to two cumulative questions. Would its absence prevent the product performing one of its functions, which is not limited to the core functionality or the intended purpose, and was the software designed and developed by the manufacturer or under its responsibility, meaning tailor-made to its own designs and specifications. Both yes makes the module part of the product. Your own software on a third-party IaaS or PaaS qualifies. A third-party SaaS application you integrate does not, and is treated as a component attracting Article 13(5) due diligence. Who operates the solution is irrelevant, so on-premises and private cloud qualify on the same terms as public cloud.

Substantial modification under Article 3(30) gains a four-factor test at guidance point 110. Does the change introduce new threat vectors, enable new attack scenarios, change the likelihood of previously identified attack scenarios, or change their impact. The scale of the change is expressly not part of the test.

Free and open-source software under Article 3(48) requires two things cumulatively. A licence granting the full set of rights, and source code that is openly shared. Software under a free licence whose source is shared only with paying customers or a limited group does not qualify.