Does the CRA apply to my SaaS product?
A service used only through a web browser is generally outside the CRA’s product scope. A downloadable client or a cloud function needed by a covered product can change the picture. Start with what the customer receives and runs, rather than the SaaS label.
First separate the service from the software you supply
The Commission’s July 2026 guidance distinguishes software supplied to a user for execution on their own system from software that runs remotely and is merely accessed by that user. A browser-only web application is not, on that basis alone, a product with digital elements.
An installed desktop client, mobile app, browser extension or on-premises agent can be a software product in its own right. Building it with web technologies does not turn a locally installed application into a browser-only service. Check each part of the offering and the functions that connect them.
Then check the cloud functions the product needs
The CRA includes a product’s remote data processing solutions. Three points matter together: processing takes place at a distance; the product would lose one of its functions without it; and the software was developed by the manufacturer or under its responsibility.
For example, a device manufacturer’s service that lets a customer control the device remotely may form part of that product. The test is not whether the product becomes completely unusable without the cloud. Losing one of its functions can be enough.
Buying a general-purpose cloud service from an independent provider does not automatically make that provider’s whole platform part of your product. Your own application code and the third-party service need to be distinguished. A dependency can still need attention in the product’s risk assessment even where it is not itself remote data processing under this definition.
Write down the product boundary
List what users download, install or receive with hardware. For each item, record where it runs, who supplies it, its intended functions and the remote services those functions depend on. Note who develops each remote service and what stops working if it is unavailable.
Next record how the offering reaches the EU market and your role in supplying it. Product scope, commercial supply, statutory exclusions and the manufacturer’s responsibilities are separate questions. A deployment diagram and a short explanation of each dependency are more useful starting evidence than a product-category label alone.
A CRA scope answer does not settle every other obligation
Being outside the CRA’s product scope does not establish that a service is outside other laws. For example, NIS2 has its own rules for cloud computing providers, while data-protection requirements depend on the processing involved. Check those frameworks separately.
Keep the answer tied to the version of the offering you assessed. Adding an installed client, selling a device or moving a function between local software and the cloud can change the facts that the scope assessment relies on.
A fictional example: one service, two delivery models
Imagine a team offering a browser-only scheduling service.
Users open the website and work entirely through the browser. That delivery model, without a connection to a separate product’s functionality, fits the guidance’s example of a web application outside the CRA’s product scope.
The team later supplies an installed desktop client that synchronises schedules through an API it develops. The client needs its own scope assessment. The API must also be checked against the remote data processing definition because the client’s synchronisation function depends on it. This does not automatically bring every internal business system into the product boundary.
What still needs checking
- The real product architecture, supply arrangements and statutory exclusions determine the outcome; this example does not decide an individual product’s status.
- Commission guidance explains the framework but is not binding legislation. The linked regulation remains the legal source.
- Scopeward’s assessment records an indicative result under its displayed ruleset version. This article does not change that ruleset or any saved assessment.
Sources and further reading
Related reading
Record your product’s starting point
Use the free assessment to record the product you supply and the facts behind its indicative result.
Start the assessment