Software manufacturers
The Cyber Resilience Act for software manufacturers
Shipped software with any data connection is squarely in the CRA's definition of a product with digital elements. The question worth your time is which role you hold, because the obligations are not evenly distributed.
This page does not tell you whether the CRA applies to you. It cannot: the answer turns on inputs only you have. What it does is name the questions that decide it, with the article behind each, so the free check takes two minutes instead of an afternoon.
The assumption to check first
“We only integrate other people's components, so the obligations sit with them.”
Placing a product on the market under your own name or trademark makes you the manufacturer for that product, whoever built the parts. Substantially modifying someone else's product can do the same.
What actually decides it
Do you place it on the market under your own name or trademark?
Article 21, Regulation (EU) 2024/2847
This is what makes the manufacturer role yours rather than your supplier's.
Do you substantially modify a product already on the market?
Article 21, Regulation (EU) 2024/2847
A substantial modification can transfer manufacturer obligations to you for the modified product.
Is it free and open-source software outside a commercial activity?
Article 3(22) and the open-source steward provisions, Regulation (EU) 2024/2847
The carve-out is real and narrower than it is usually quoted. Monetising around a project can pull it back in.
Is it supplied in the course of a commercial activity?
Article 3(22), Regulation (EU) 2024/2847
Paid or free makes no difference. "Free" is the most common reason a team wrongly assumes it is out.
Is the product placed on the EU market?
Article 2(1), Regulation (EU) 2024/2847
Scope follows the market, not your address. A company outside the EU that sells into it is in; an EU company selling only elsewhere is not.
What to do next
- 1.Run the scope check and note the role it returns, not just the verdict.
- 2.If you are the manufacturer, the reporting duty on 11 September is the first thing with a date on it.
- 3.Write down what counts as active exploitation for your product before you need the definition.