Does the CRA apply to you? 10 real-world examples from the Commission guidance

For a small company, "does the CRA apply to us?" is the first and most important question — until you answer it, there is no point worrying about documentation or reporting. Regulation (EU) 2024/2847 has a broad but precise definition: it applies to whoever commercially places a "product with digital elements" on the EU market. Let's translate that into ten concrete situations that small software companies meet most often. For each, we say where it lands and under which provision.

The key: what a "product with digital elements" is

Under Article 3, a product with digital elements is a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately. A manufacturer is whoever develops the product or has it developed and markets it under its own name or trademark. And "placing on the market" is the first making available in the EU in the course of a commercial activity. Three words carry most of the decision: commercial, under your own brand, made available on the market.

Ten examples

1. A desktop application the customer installs. A classic product with digital elements (Art. 3). You are the manufacturer; the full scope applies — Annex I, documentation, reporting under Article 14. Company size is irrelevant; the regulation has no exemption for micro-enterprises, only simplified documentation.
2. A mobile app you sell or monetise. Also a product: the customer installs it onto a device. Even a free app is "commercial" if it is part of a paid offering (for example, a free client for a paid service).
3. SaaS to which you ship a client app or agent. The cloud service itself is mostly out of scope, but the installable client or agent is a product — and the cloud part that is necessary for its function is, under Art. 3, a "remote data processing solution" and is taken together with it.
4. Pure SaaS — the customer installs nothing, everything runs on your side. Mostly out of the CRA's scope (recital 12: a service as such is not a product with digital elements). But watch out for NIS2 if you fall within it — that is separate legislation.
5. A plugin, library or SDK you distribute commercially. A component placed on the market separately is also a product with digital elements under Art. 3. If you sell it or it is part of a commercial offering, you are the manufacturer.
6. Firmware for a device you make or brand. Hardware with software is the textbook case. The full scope applies, including the secure-by-design properties in Annex I.
7. An open-source project with no commercial purpose. If you develop the code non-commercially (a community, a foundation) and do not monetise it, you are outside the manufacturer's obligations. If you systematically support open source intended for commercial use, you may be an "open-source software steward" (Art. 24) with a lighter regime — a cybersecurity policy (Art. 24(1)) and cooperation, no CE. Note: once you monetise the open source (a paid edition, licences), you become a manufacturer.
8. Internal software for your own use only. If you do not make it available on the market, it is not "placed on the market" (Art. 3) — out of scope. But the moment you start selling or supplying it to third parties, that changes.
9. Custom software built for a client. The manufacturer is usually whoever places the product on the market under its own brand — that is, the client. The agency is typically involved indirectly, but if you appear under your own brand (you are the manufacturer already by the definition in Art. 3) or make a substantial modification (Art. 22), you can become the manufacturer. The Commission guidance also works through these edge cases.
10. You resell or distribute non-EU software or devices. You have importer or distributor duties (Art. 19–20): verify that the manufacturer carried out the conformity assessment and CE marking, that documentation is available, and report risks. If you place the product under your own brand or substantially modify it, you become the manufacturer (Art. 21).

Why company size doesn't decide

The most common misconception goes: "we're a small company / micro-enterprise, this doesn't apply to us." It's not so. The regulation has no exemption by size — it doesn't distinguish whether you're a corporation or a single sole trader. What it does take into account is only simplified technical documentation for micro and small enterprises, and measures proportionate to the product's risk. So what decides is what you do (do you place a product with digital elements on the market?), not how big you are.

Price doesn't decide either. "Free product" isn't automatically out: if a free app is part of a commercial offering (e.g. a free client for a paid service, or a tool that funnels users into a paid ecosystem), it counts as placed on the market in the course of a commercial activity (Art. 3). Genuinely out is only non-commercial provision with no monetisation whatsoever.

What to do next

If you found yourself in points 1, 2, 3, 5 or 6, you are most likely a manufacturer, and two dates concern you: 11 September 2026 (reporting under Article 14, including for products you already sell) and 11 December 2027 (full conformity and CE). The first thing to do then is determine your product class — most ordinary software is in the mildest "default" class with self-assessment — and produce an SBOM and a reporting channel.

Points 4, 7 and 8 usually leave you out — but the edges (SaaS, open source, internal use) are being refined in the Commission FAQ, so it is worth confirming and dating your result. Points 9 and 10 mean indirect or specific duties, which we cover in separate articles: custom software and importers and distributors. And if you ever alter someone else's product in a way that changes its security properties (a substantial modification), or sell it under your own brand, you flip into the manufacturer role under Art. 21 — even if you started out as "just" a distributor.

How CRAguard helps

We packed exactly this first question into a two-minute scope-checker: answer six questions and it tells you which of these categories you fall into and what follows. If you already know you are a manufacturer, a good second step is an SBOM in minutes. Find out whether the CRA applies to you, or join the waitlist — we'll let you know at launch.

This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (Art. 3, 14, 19–22, 24, recital 12) and the European Commission's guidance of 27 July 2026. Consult a professional on edge cases (SaaS, open source, custom development).