Does the EU Cyber Resilience Act apply to SaaS?
Pure SaaS is mostly outside the EU Cyber Resilience Act — but the exceptions catch more products than founders expect. Here is the actual legal test, with sources.
CRA articles for software companies
Written for people who ship software rather than devices, and sourced against the text of Regulation (EU) 2024/2847 rather than against other people's summaries.
CRA compliance checklist for software companies (2026–2027)
A phased, source-cited CRA checklist for software companies: what to do now, what the reporting obligations require, and what the full application of the Regulation asks for.
What the CRA's September 2026 reporting obligations mean in practice
Manufacturers must report actively exploited vulnerabilities within 24 hours. What Article 14 actually requires, who it covers, and how to prepare — with sources.
CRA product classes explained: default, important, critical — with examples
Default, important (class I and II) or critical? What the CRA's product classes actually change — including the harmonised-standards catch nobody mentions. With sources.
Not sure where you stand? Run the two-minute scope check — verdict, role, product class and the dates that apply to your case.