CVD Portal
← Commission worked examplesScope

What counts as a product with digital elements under the Cyber Resilience Act?

10 worked examples from Commission guidance C(2026) 5252 final, reproduced word for word.

Also asked

  • Does the Cyber Resilience Act apply to mobile apps?
  • Is a web application covered by the CRA?
  • Is source code a product with digital elements?
  • Are a device and its companion app one product under the CRA?
  • Does a website fall under the Cyber Resilience Act?

The Cyber Resilience Act reaches software that is supplied to a user and executes on that user's device. A mobile application, a desktop application built with web technologies, and source code licensed in a text file are all products with digital elements. A web application used only through a browser is not, unless it supports the functionality of a product that is. Hardware and software that cannot deliver their purpose without each other form one product, even when they are supplied through different channels.

Scope also requires the supply to be in the course of a commercial activity. The examples below settle what a product is, not whether your supply of it is commercial.

At a glance

Test for software
Supplied to the user and executes on the user's device
Browser-only web app
Not a product with digital elements
Source code
Placing it on the market, even before compilation (Example 7)
Hardware plus separate software
One product where neither fulfils the purpose alone
Placing on the market
Fixed at the date the version is first supplied (Examples 1 and 2)

Last reviewed 27 July 2026

Verified against The Annex to Commission Communication C(2026) 5252 final of 27 July 2026, and Regulation (EU) 2024/2847 as published in OJ L, 20.11.2024, read at EUR-Lex on 27 July 2026

Every copy of a version is placed on the market on the same day

Article 3, point (21) defines placing on the market as the first making available of a product on the Union market.[2] The guidance applies that to software versions rather than to individual copies. A copy sold two weeks after the version was first supplied was still placed on the market on the day the version was.

This matters for the transitional dates. A version first supplied before 11 December 2027 does not become newly subject to the CRA because someone downloads it afterwards. An update that is not a substantial modification does not restart the clock either, which is what Example 2 is for.[1]

CRA referenceArticle 3, point (21)

The dividing line for software is where it executes

Examples 3 to 6 draw one line four times. Software supplied to the user and executing on the user's device is a product with digital elements. Software the user only reaches through a browser is not.

The packaging technology is irrelevant. A desktop application built with web technologies but installed locally is in scope, because what matters is that it is supplied and runs on the device. An informational website is out of scope entirely.

Example 5 carries the sting. If a locally installed client depends on data processing at a distance in order to perform one of its functions, that remote processing is part of the product. Moving logic to your back end does not move it out of scope.

CRA referenceArticle 3, points (1) and (2)

Source code counts, and so do products split across two supply channels

Example 7 confirms that licensing source code in a text file is placing a product on the market, even where the licensee must adapt and compile it before use. Responsibility stops at the code as supplied. The licensee owns whatever it does next.

Examples 8 and 9 handle the case where a product arrives in two pieces. A network printer and its downloadable drivers are one product, because the printer cannot fulfil its intended purpose without them. A fitness wearable and the app that displays and configures it are one product, because they are designed and intended to operate together. Different distribution channels do not create different products.[1]

CRA referenceArticle 3, points (1) and (2)

Being in scope of the CRA does not put you out of scope of anything else

Version 13 of the Commission's FAQs adds a scope example the guidance does not. Software procured by a hospital to store and view patient summaries can be a product with digital elements under the CRA and an EHR system under the European Health Data Space Regulation at the same time.[3]

Overlap is the norm rather than the exception. Article 26(2) required the guidance to address the interplay between the CRA and other Union law, and the Commission has signalled that further guidance may follow on the AI Act and DORA.

CRA referenceArticle 2 and Article 26(2)

The Commission’s examples, word for word

10 examples, reproduced exactly as published. Each carries the section, guidance point and page it comes from. The bold line above each quotation is our summary of the outcome and is not part of the source.

Example 1

Section 2.1 Placing on the market, point 14, page 8

Every copy of a version is placed on the market on the day that version is first supplied

On 1 January 2028, company A first supplies for distribution via its website version 1.0.0 of its software X. On the same day, customer 1 purchases a copy of version 1.0.0 of software X. On 15 January 2028, customer 2 purchases a copy of version 1.0.0 of software X. Both copies of version 1.0.0 of software X are placed on the market on 1 January 2028.

Example 2

Section 2.1 Placing on the market, point 15, page 8

An update that is not a substantial modification does not create a new placing on the market

On 1 January 2028, company A first supplies for distribution via its website version 1.0.0 of software X. On the same day, customer 1 purchases a copy of version 1.0.0 of software X. On 15 January 2028, company A issues an updated version 1.0.1 of software X that does not constitute a substantial modification. On 30 January 2028, customer 2 purchases a copy of version 1.0.1 of software X. Both copies of version 1.0.0 and 1.0.1 of software X are considered to be placed on the market on 1 January 2028.

Example 3

Section 2.2 Software as a product with digital elements, point 21, page 10

In scope. A mobile app executes on the user's device

a mobile application that a user downloads from an app store and installs on their smartphone is supplied to the user and executes on the user's device and is therefore a product with digital elements. Where it is placed on the market in the course of a commercial activity, it may fall within the scope of the CRA.

New in the adopted text. It has no counterpart in the earlier consultation draft.

Example 4

Section 2.2 Software as a product with digital elements, point 21, page 10

In scope. Web technology packaged for local installation is still local software

a desktop application built using web technologies but packaged for local installation is supplied to the user and executes on the user's device, and is therefore a product with digital elements. Where it is placed on the market in the course of a commercial activity, it may fall within the scope of the CRA.

New in the adopted text. It has no counterpart in the earlier consultation draft.

Example 5

Section 2.2 Software as a product with digital elements, point 21, page 10

Browser-only web application is out of scope. A local client is in scope, and pulls its remote data processing with it

a web application accessed by the user exclusively through a web browser is not a product with digital elements. Unless it supports the functionality of a product with digital elements, it does not fall within the scope of the CRA. By contrast, an application supplied to the user as a locally installed client that executes on the user's device is a product with digital elements. Where it is placed on the market in the course of a commercial activity, it may fall within the scope of the CRA. If that client relies, in order to perform one or more of its functions, on data processing at a distance which meets the definition of remote data processing, that data processing at a distance is also part of the product with digital elements.

New in the adopted text. It has no counterpart in the earlier consultation draft.

Example 6

Section 2.2 Software as a product with digital elements, point 21, page 10

Out of scope. An informational website is not a product with digital elements

a website that merely presents information to its visitors and does not support the functionality of a product with digital elements is not itself a product with digital elements. It therefore does not fall within the scope of the CRA.

New in the adopted text. It has no counterpart in the earlier consultation draft.

Example 7

Section 2.3 Computer code, point 24, page 11

Licensing source code is placing it on the market, even before compilation

Company A licences source code to company B for a customisable internal platform, and provides that source code in a text file. Even if that source code requires further adaptation and compilation by company B before being used, company A is placing that source code on the market and is therefore subject to the CRA. Company A is not responsible for the compliance with the CRA of company B's subsequent adaptations and compilation of that code.

Example 8

Section 2.4 Combination of hardware and software forming a product with digital elements, point 25, page 11

Printer plus separately downloaded drivers is one product

A network printer is placed on the market as a hardware product with digital elements, while the software drivers required to send print jobs, configure the device and manage its operation are made available for download from the manufacturer's website. Although the printer and the drivers are supplied through different channels, they together constitute a single product with digital elements, because the printer cannot fulfil its intended purpose without the drivers.

Example 9

Section 2.4 Combination of hardware and software forming a product with digital elements, point 25, page 12

Wearable plus companion app is one product

A fitness wearable is placed on the market to measure a user's heart rate and activity, while a smartphone application provided by the manufacturer is required to display the measurements, show history and allow configuration of the device. Although the application is downloaded separately through an app store, the wearable and the application together constitute a single product with digital elements, because they are designed and intended to operate together to deliver the functionality of the product with digital elements.

Commission FAQ example

Section 2.7.1 What is the interplay between the CRA and the European Health Data Space Regulation?, page 19

One product can be both a product with digital elements and an EHR system

A computer or a software that has been marketed and procured by a hospital designed for storing and viewing patient summaries while delivering healthcare services, could be a product with digital elements within the meaning of the CRA that is also an EHR system, within the meaning of the EHDS Regulation.

From the Commission's FAQs on the Cyber Resilience Act, version 13, not from the adopted guidance.

Sources

Every claim above traces to one of these. Items marked Binding are law in force. Everything else is interpretive and is labelled as such.

  1. [1]
    Commission guidance on the application of Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)Commission guidance

    European Commission · Sections 2.1 to 2.4, points 14 to 25 · C(2026) 5252 final · Final, adopted 27 July 2026

    Article 26 guidance sets out the Commission's interpretation of the CRA. It does not bind economic operators, and only the Court of Justice of the European Union can give an authoritative interpretation of the Regulation.

    Accessed 2026-07-27

  2. [2]
    Regulation (EU) 2024/2847 of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)Binding

    European Union · Article 3, points (1), (2) and (21) · CELEX:32024R2847

    “'product with digital elements' means a software or hardware product and its remote data processing solutions”

    Accessed 2026-07-27

  3. [3]
    FAQs on the Cyber Resilience ActCommission FAQ

    European Commission · Section 2.7.1, interplay with the European Health Data Space Regulation · Version 13

    The Commission FAQs are explanatory material and carry no legal force.

    Accessed 2026-07-27

  4. [4]
    Regulation (EU) 2024/2847 of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)Binding

    European Union · Article 2, scope · CELEX:32024R2847

    Accessed 2026-07-27

Further reading on this site

Related questions

Does the CRA cover my web application?Does the EU Cyber Resilience Act apply to open source software?

Turn the guidance into an audit-ready file

Free CRA classification for your product, a vulnerability disclosure portal on your own domain, and Article 14 deadline tracking. Receiving and tracking reports is free for every manufacturer placing products with digital elements on the EU market.

Classify my productStart your free portal