Does the CRA cover my web application?

Article 3(1) defines a product with digital elements as a software or hardware product and its remote data processing solutions.^[2] Commission guidance C(2026) 5252 explains what that requires of software. For software to fall in scope, it must be provided to a user, obtained by that user, and operated on or as part of an electronic information system on the user's side.^[5]

Software that executes remotely and is merely accessed by the user does not meet that description. The guidance names web applications, including progressive web apps, where they are accessed exclusively through a web browser. Recitals 11 and 12 support the reading, treating processing at a distance as relevant only to the extent it is necessary for a product to perform its functions.^[4]

Websites get the same treatment. Even though a website technically executes to a limited extent on the user's device, recital 12 means websites are not themselves products with digital elements. A site that merely presents information to visitors is outside the CRA even where a product links to it.

The delivery model decides this, and the technology stack does not. A desktop application built using web technologies but packaged for local installation is supplied to the user and executes on the user's device, so it is a product with digital elements.^[5] The same applies to a browser extension. A mobile application downloaded from an app store is squarely in scope.

So the common pattern of a browser-based product that also ships a desktop or mobile client splits. The browser-accessed part is out of scope on its own account. The installed client is in scope. Where that client relies on data processing at a distance in order to perform one of its functions, and that software was designed and developed by you or under your responsibility, the processing is part of the product as a remote data processing solution.

That last point catches many teams by surprise. Your backend does not escape the CRA because it lives on a server. It escapes because nothing you place on the market depends on it.

Scope also requires that the product is made available on the EU market in the course of a commercial activity.^[1] The guidance devotes a full section to what that means for free and open-source software, and the tests are decisive rather than cumulative.

Charging a price puts you in. So does monetising other services through the software, or requiring the processing of personal data as a condition of use for reasons beyond security, compatibility or interoperability. Selling optional professional services around software that anyone can download freely does not. Accepting donations generally does not, unless access or updates are in practice conditioned on donating.^[5]

Where free and open-source software is published but not placed on the market, the publisher may still be an open-source software steward under Article 24, with a narrower and graduated set of obligations.^[3]

A browser-only web application sits outside the CRA and inside other regimes. Recital 12 of the CRA itself points to Directive (EU) 2022/2555, which establishes cybersecurity risk-management requirements for cloud computing service providers, further specified by Implementing Regulation (EU) 2024/2690.^[6]

Financial entities and their ICT service providers face Regulation (EU) 2022/2554 on digital operational resilience. Any service processing personal data remains subject to the GDPR, including its own breach-notification timetable. The Commission has said it may issue further guidance on how the CRA interacts with the AI Act and with DORA.^[5]

The practical step is to establish scope before doing classification work. Determining whether you are in scope at all takes minutes, and it decides whether the Annex III and IV classification exercise is relevant to you.