Scope

Does the CRA apply to SaaS?

By HEXENKRAFT. Reviewed against the primary text in August 2026.

The short answer that circulates online ("SaaS is exempt") is half right and dangerously incomplete. The CRA governs products with digital elements, and its definition matters more than the marketing name of what you sell.

“a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately” (Art. 3, point (1), definitions, 'product with digital elements' · Regulation (EU) 2024/2847, OJ L, 20.11.2024)

The default: pure services are out

If nothing is ever supplied to the customer's systems (your code runs entirely on your infrastructure; customers interact through a browser), you are generally not supplying a product with digital elements. The service is a service, not a product on the market.

The exceptions that pull you back in

Client software. A mobile app, desktop agent, browser extension, or on-prem connector that accompanies your service is installable software, and it can be in scope on its own merits, and the backend may then count as its remote data processing solution (Art. 3, point (2)).
Hardware bundles. Sell your platform together with a gateway, sensor or appliance and the hardware is a product with digital elements in its own right, and the platform may be its remote data processing solution.
On-prem deployments. The day you ship a customer-hosted instance, you are placing software on the market.

The audit question

Not "are we SaaS?" but "what does the customer actually run?" Inventory every artifact that lands outside your infrastructure: apps, agents, SDKs that execute customer-side, connectors, even setup utilities. Each one needs its own scope assessment, and each may carry a different classification (Annex III or IV) from the parent product.

Open-source publishers face a related trap: monetising open-source code, for example through paid tiers, can bring the software into scope as a commercial activity (recitals 15 and 18).

For the whole scope question across software, hardware, exclusions and roles, see Does the Cyber Resilience Act apply to my product?

Check both sides of the line. Run the free Cybiq check once for the service, once for any client component: grey-zone answers come with concrete next steps instead of a fake verdict.

Orientation, not legal advice. Verify against the official text before relying on any item.