Does the CRA apply to browser extensions?
Likely yes
Likely yes when it is monetised. An extension is installed software with a network connection, so it is a product with digital elements; it is in scope once it is made available in the EU in the course of a commercial activity [[F-005]] [[F-007]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Made available on the EU market | Scope questions continue | Likely out of scope | F-101 |
| Supplied in the course of a commercial activity | Scope questions continue | Likely out of scope (or the open-source light regime) | F-007 |
| Has a direct or indirect connection to a device or network | It is a product with digital elements | Likely out of scope | F-005 |
| Product cannot perform a function without your own backend | That remote processing is part of the product | Only the installed part is the product | F-107 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Password-manager extension sold on subscription
Likely in scope · role: _
Installed, connected, and paid for: a product with digital elements made available on the EU market in the course of a commercial activity.
Deciding fact: Art. 3(1), Art. 2(1)
-
Free extension that monetises through affiliate links
Likely in scope · role: _
Monetisation is a commercial activity even when the user pays nothing, so the extension is placed on the market.
Deciding fact: Art. 3(1), Art. 2(1)
-
Extension listed only in store regions that exclude the EU
Likely out of scope · role: _
Nothing is made available on the EU market, so the Regulation does not apply until the store listing changes.
Deciding fact: Art. 3(22)
-
Open-source extension maintained by a non-profit foundation, no monetisation
Open-source light regime may apply · role: _
Not monetised free and open-source software is not considered placed on the market; the foundation may be an open-source software steward under the light regime.
Deciding fact: Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
Extensions are installed software
The Regulation's definition of a product with digital elements is broad: a software or hardware product with a direct or indirect connection to a device or network, including components placed on the market separately [1]. An extension is installed into a browser, runs with network access, and is supplied separately from the browser: every element is met.
Commercial or not
Applicability then turns on commercial activity. Charging a subscription, charging for support, or monetising through advertising or affiliate arrangements all count as making the product available in the course of a commercial activity [2]. An extension a company publishes for free, with no monetisation and no paid support, sits closer to the non-commercial line; the scope check asks you to answer that fact rather than assume it [2].
Companion extensions
Many extensions are the client of a service. Where the extension cannot perform a function without your own backend, that remote data processing is part of the product [3]. The extension and the backend are then one product with digital elements for the purposes of the Regulation [1].
Availability in the EU
Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity [4]. Store region settings decide this fact. An extension geo-restricted away from every EU storefront is not in scope, and becomes so the day the restriction is lifted [4].
Timing
Article 14 reporting applies from 2026-09-11; full requirements and CE marking apply from 2027-12-11. Dates come from the Facts Table entries cited below, evaluated for the first example; run the check for your own product's dates.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-107 Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII EUR-Lex ↩
- F-101 Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) EUR-Lex ↩
- F-009 Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19 EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.