Scope

Does the CRA apply to SaaS?

Reviewed August 2026 against Regulation (EU) 2024/2847, OJ L, 12.12.2024.

The short answer that circulates online ("SaaS is exempt") is half right and dangerously incomplete. The CRA governs products with digital elements, and its definition matters more than the marketing name of what you sell.

“a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately” (Art. 2, definitions, CELEX 32024R2847)

The default: pure services are out

If nothing is ever supplied to the customer's systems (your code runs entirely on your infrastructure; customers interact through a browser), you are generally not supplying a product with digital elements. The service is a service, not a product on the market.

The exceptions that pull you back in

Client software. A mobile app, desktop agent, browser extension, or on-prem connector that accompanies your service is installable software, and it is in scope on its own merits, even if the backend stays out.
Hardware bundles. Sell your platform together with a gateway, sensor or appliance and the hardware side of the CRA applies to that combination.
On-prem deployments. The day you ship a customer-hosted instance, you are placing software on the market.

The audit question

Not "are we SaaS?" but "what does the customer actually run?" Inventory every artifact that lands outside your infrastructure: apps, agents, SDKs that execute customer-side, connectors, even setup utilities. Each one needs its own scope assessment, and each may carry different classification (Annex III/IV) than the parent product.

Open-source publishers face a related trap: monetised distribution or paid tiers around OSS code pull the software back into scope like any commercial product.

Check both sides of the line. Run the free Cybiq check once for the service, once for any client component: grey-zone answers come with concrete next steps instead of a fake verdict.

Orientation, not legal advice. Verify against the official text before relying on any item.