Cyber Resilience Act Products with Digital Elements Scope

Article 3 defines a product with digital elements as a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately. The Commission FAQ lists standalone software, downloadable apps, programs, firmware, integrated circuits, motherboards, and sensors as examples that can qualify when the other scope conditions are met.

Article 2 adds the connection requirement. The product's intended purpose or reasonably foreseeable use must include a direct or indirect logical or physical data connection to a device or network. The FAQ treats indirect connections seriously: software that does not itself communicate may still be indirectly connected through the host system on which it runs.

Remote data processing is part of the product only when the Article 3(2) definition is met: processing takes place at a distance, the relevant software is designed and developed by the manufacturer or under its responsibility, and the product would not perform one of its functions without it. Recital 11 gives the useful pattern: a mobile app that needs a manufacturer-provided API or database service for one of its functions can bring that remote processing inside the product boundary.

That does not mean every hosted system behind a product is in scope as remote data processing. The CRA and Commission materials distinguish product-function software from surrounding infrastructure, general connectivity, analytics, websites that only provide information, and third-party SaaS that the manufacturer did not design or commission.

An integrated software or hardware component forms part of the product with digital elements. A remote data processing solution can also form part of the product if it meets Article 3(2). Other outside systems may remain external dependencies, but Article 13 still requires the manufacturer to assess cybersecurity risks affecting the product and to exercise due diligence when integrating third-party components.

This distinction matters because a component supplier's CE marking, update practice, vulnerability history, or security evidence can support the finished-product assessment, but it does not transfer the finished-product manufacturer's CRA responsibility. The manufacturer remains responsible for the product as placed on the market.

Even where the product appears to meet the products-with-digital-elements definition, Article 2 can remove it from the CRA. The main grounded exclusions include products covered by the EU medical device and in vitro diagnostic medical device regulations, products covered by the vehicle type-approval regulation, products certified under the civil aviation framework, marine equipment, identical spare parts made to replace components to the same specifications, and products developed or modified exclusively for national security or defence purposes.

The exclusion should be documented against the specific legal basis, not a shorthand label. Some sector boundaries require a cross-check against the sector law and the exact product status, such as whether the product is actually covered or certified under the named regime.

Open-source status does not by itself decide CRA scope. The CRA focuses on whether the software is supplied for distribution or use on the Union market in the course of a commercial activity. Recitals 15, 18, and 19 draw boundaries for monetisation, donations, regular releases, repository hosting, and open-source software stewards.

For a scope record, separate the software publisher's role from the integrating manufacturer's role. A non-commercial FOSS component may remain outside the manufacturer regime for its publisher, while a manufacturer that integrates it into a commercial product still has due-diligence and vulnerability-handling duties for the finished product.

Once a product is in scope, the next question is role allocation. The CRA distinguishes manufacturer, authorised representative, importer, distributor, and other persons subject to obligations for manufacture or market availability. A company that markets a product under its own name or trademark can be the manufacturer even when another party built it.

Importers and distributors have real checks, but they are not second manufacturers by default. Importers check conformity assessment, technical documentation, CE marking, declaration of conformity, user information, and manufacturer traceability obligations before placing the product on the market. Distributors verify marking, documentation, traceability, and necessary documents before making the product available. Either role can become the manufacturer if it markets the product under its own name or substantially modifies it.