Does the EU Cyber Resilience Act apply to SaaS?

Short answer: pure SaaS — software your customers only ever reach through a browser — is generally outside the scope of the EU Cyber Resilience Act. But the moment your product includes anything that runs on the customer's side, or your cloud backend is essential to a product you ship, you are likely inside it. The dividing line is a specific legal test, and it catches more products than most founders expect.

The CRA — Regulation (EU) 2024/2847 — is the EU's horizontal cybersecurity law for "products with digital elements". Its main obligations applies from 11 December 2027; the reporting obligations have applied since 11 September 2026 (Article 71). Penalties for non-compliance with the essential requirements can reach €15 million or 2.5% of global turnover, whichever is higher. So "does it apply to us?" is worth answering precisely, not by folklore.

What the CRA actually covers

The Regulation applies to products with digital elements made available on the EU market, whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1)). A "product with digital elements" is defined as "a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately" (Article 3(1)).

Two things in that definition matter enormously for SaaS companies:

First, software products are squarely in scope. Not just firmware or IoT — desktop applications, developer tools, commercial plugins, libraries and components sold separately all qualify, when made available in the EU in the course of a commercial activity ("whether in return for payment or free of charge" — Article 3(22); free products distributed commercially are not exempt).

Second, "remote data processing solutions" are part of the product. This is the clause that decides most SaaS cases.

The test that decides SaaS: remote data processing

Article 3(2) defines remote data processing as "data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions."

Read that carefully. The CRA does not regulate cloud services as such — services like pure SaaS platforms fall under a different law (NIS2, for those in its scope). What the CRA regulates is a product, and it pulls the product's cloud components into scope when the product needs them to function.

That produces four common scenarios:

1. Pure browser-based SaaS, nothing shipped to the customer. No product with digital elements is being placed on the market — you are providing a service. Likely out of CRA scope. (Your obligations, if any, come from NIS2 or sector rules.)

2. SaaS with a shipped component: a desktop app, mobile app, local agent, CLI, browser extension, or plugin. That component is a product with digital elements. And your cloud backend, if the component cannot perform its functions without it, is a remote data processing solution belonging to that product — inside the scope of your CRA obligations. Likely in scope.

3. Downloadable software with optional cloud features. The shipped software is in scope as a product. Whether the cloud side is included depends on the same test: essential to a function, or genuinely optional.

4. APIs, SDKs, and components sold to other companies. Components placed on the market separately are explicitly within the definition (Article 3(1)). If EU customers embed your SDK in their products, the CRA is your problem too — and increasingly your customers' procurement teams will make sure of it.

The exclusions that do not save you

Article 2 excludes products covered by sector regimes — medical devices, civil aviation, motor vehicles, marine equipment — and products developed exclusively for national security or defence. Note what is not on that list: "we're a startup", "we're B2B", "we're not European" (the trigger is placing on the EU market, not where you are incorporated), and "our product is free" (commercial activity includes free distribution tied to a commercial offering).

Open source has its own carve-outs — genuinely non-commercial free and open-source software is largely outside the scope, and the Regulation created a lighter "open-source software steward" regime (Article 24) — but monetised open source (dual licensing, paid support tiers, hosted versions) needs case-by-case analysis. The European Commission has published official guidance on these boundary questions, including a dedicated resource on open source.

If you are in scope, what changes?

The essential requirements of Annex I: security by design, secure-by-default configuration, no known exploitable vulnerabilities at release, a machine-readable SBOM covering at least top-level dependencies, a coordinated vulnerability disclosure policy, secure update mechanisms, and a documented support period of at least five years in the general case (Article 13(8)). Plus technical documentation (Annex VII), a conformity assessment, CE marking — and mandatory reporting of actively exploited vulnerabilities within 24 hours, in force since 11 September 2026 (Article 14).

If your product falls into one of the "important" categories of Annex III — password managers, VPNs, identity management, operating systems, SIEM and others — the conformity assessment route gets stricter, and the current delays in the harmonised standards make that route stricter still in practice.

The honest conclusion

Whether the CRA applies to your SaaS is not answered by the word "SaaS" — it is answered by what you ship, what your cloud does for what you ship, and how you distribute it. Most companies we see are surprised in one direction or the other.

→ Check your product's CRA scope in about two minutes — free, with cited sources. You'll get a verdict with a confidence level, your likely role in the supply chain, your product class estimate, and the dates that apply to your case.

---

This article is general information about Regulation (EU) 2024/2847, not legal advice. Sources: Regulation (EU) 2024/2847 (EUR-Lex, Official Journal) — Articles 2, 3, 13, 14, 24, 71 and Annexes I, III, VII; European Commission CRA guidance; Commission — CRA and open source. Last reviewed: August 2026.