Does the CRA apply to AI products?
It depends
It depends on how it is delivered, not on the AI. An installed app, agent, SDK or on-device model supplied commercially is a product with digital elements [[F-005]]. A hosted model reached only through an API, with nothing installed, is a cloud service outside the Regulation [[F-008]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Made available on the EU market | Scope questions continue | Likely out of scope | F-101 |
| Supplied in the course of a commercial activity | Scope questions continue | Likely out of scope (or the open-source light regime) | F-007 |
| Any installed app, agent, SDK or on-device model | That part is a product with digital elements | Hosted API only: a cloud service, NIS2 may apply | F-005 |
| Product cannot perform a function without your own backend | That remote processing is part of the product | Only the installed part is the product | F-107 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Hosted model reached only through your API, nothing to install
Likely out of scope · role: _
With nothing installed there is no product with digital elements; the hosted service is a cloud service outside this Regulation; NIS2 may apply instead.
Deciding fact: Art. 3(1)–(2), Recitals
-
Desktop assistant app that cannot answer without your hosted model
Likely in scope · role: _ · remote processing in scope
The installed app is a product, and the hosted model it depends on is remote data processing that is part of it.
Deciding fact: Art. 3(1), Art. 2(1)
-
Paid on-device model SDK licensed to EU app developers
Likely in scope · role: _
A software component placed on the market separately, supplied commercially: a product with digital elements.
Deciding fact: Art. 3(1), Art. 2(1)
-
Not sure whether the client library is essential to the service
It depends on one fact · role: _
Delivery form decides. Establish whether customers install anything and whether it depends on your backend; the result then resolves.
Deciding facts: Art. 3(1), Art. 2(1); Art. 3(2); Art. 3(1)–(2), Recitals
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
The test does not mention AI
A product with digital elements is a software or hardware product, including its remote data processing solutions, with a direct or indirect connection to a device or network [1]. Nothing in the definition turns on whether the software uses a model. Applicability is decided by what is supplied and how, exactly as for any other software [2].
Hosted API only
Cloud services that are not part of a product are outside this Regulation and may fall under NIS2 instead [3] [4]. A model that customers reach only through an API, with no installed client of yours, is a cloud service in this sense [3].
Installed apps, agents and SDKs
An installed assistant, a desktop agent, a client library or an on-device model is a software product or component placed on the market separately [1]. Where it is designed to rely on your own remote data processing and cannot perform a function without it, that remote processing is part of the product with digital elements [5] [6].
Integration into someone else's product
A developer who integrates your component into their product is the manufacturer of that product and responsible for its conformity, including the integrated component [7]. You remain responsible for the component you place on the market [1].
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-008 Cloud services that are not part of a product are outside the Regulation (they fall under NIS2); remote data processing essential to a product is within scope as part of that product. Art. 3(1)–(2), Recitals EUR-Lex ↩
- F-103 Cloud services may fall under NIS2 (Directive (EU) 2022/2555) rather than the CRA. NIS2 EUR-Lex ↩
- F-006 Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Art. 3(2) EUR-Lex ↩
- F-107 Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII EUR-Lex ↩
- F-104 A developer who integrates a component into their own product is the manufacturer of that product and responsible for its conformity, including the integrated component. Art. 13(5), Art. 3(13) EUR-Lex ↩
- F-101 Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.