Does the CRA apply to embedded software?
Likely yes
Likely yes. Embedded software supplied with a connected device, or licensed separately as a component, is a product with digital elements once made available in the EU in the course of a commercial activity [[F-005]] [[F-007]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Made available on the EU market | Scope questions continue | Likely out of scope | F-101 |
| Supplied in the course of a commercial activity | Scope questions continue | Likely out of scope (or the open-source light regime) | F-007 |
| Has a direct or indirect connection to a device or network | It is a product with digital elements | Likely out of scope | F-005 |
| Integrated into a product by another manufacturer | That manufacturer is responsible for the finished product | You are responsible as the component's manufacturer | F-104 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Runtime licensed to EU machine builders as a separate component
Likely in scope · role: _
A software component placed on the market separately, supplied commercially: a product with digital elements in scope.
Deciding fact: Art. 3(1), Art. 2(1)
-
Control software running on machinery already sold in the EU since 2020
Likely in scope · role: _
In scope, with full requirements triggered only by a substantial modification after 11 December 2027; reporting obligations apply regardless.
Deciding fact: Art. 3(1), Art. 2(1)
-
Software for a type-approved vehicle control unit
Likely out of scope · role: _
Type-approved motor-vehicle products are excluded from this Regulation.
Deciding fact: Art. 2(2)–(4), (6)–(7)
-
Not sure whether the OEM licensing counts as commercial supply
It depends on one fact · role: _
Commercial activity is the deciding fact. A licence fee or paid support is commercial supply.
Deciding facts: Art. 3(1), Art. 2(1); Art. 2(1), Art. 3(22), Recitals
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
Embedded software is a product, shipped inside or sold separately
The definition of a product with digital elements includes software or hardware components placed on the market separately [1]. Firmware licensed to an OEM is such a component. Firmware shipped inside a device is part of that device's product. Either way it is in scope once supplied commercially in the EU [2] [3].
Who answers for what
A developer who integrates a component into their own product is the manufacturer of that product and is responsible for its conformity, including the integrated component [4]. The component supplier is responsible for the component as placed on the market [1]. Both remain true; each party runs the scope check for what it actually supplies.
Machinery already installed
Products placed on the market before 11 December 2027 are subject to the Regulation only if substantially modified after that date, while Article 14 reporting obligations still apply to them [5]. A substantial modification is a change that affects compliance with the essential requirements or modifies the intended purpose [6]. Maintenance releases that do neither do not trigger full application; a new function that does is a different matter.
Sector exclusions
Type-approved motor-vehicle products, medical devices and certain aviation, marine and defence cases are excluded and follow their own regimes [7].
Timing
Article 14 reporting applies from 2026-09-11; full requirements and CE marking apply from 2027-12-11. Dates come from the Facts Table entries cited below, evaluated for the first example; run the check for your own product's dates.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-101 Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) EUR-Lex ↩
- F-104 A developer who integrates a component into their own product is the manufacturer of that product and responsible for its conformity, including the integrated component. Art. 13(5), Art. 3(13) EUR-Lex ↩
- F-004 Products placed on the market before 11 December 2027 are subject to the Regulation only if substantially modified after that date; Article 14 applies to them regardless. Art. 69(2)–(3) EUR-Lex ↩
- F-014 Substantial modification: a change after placing on the market affecting compliance with essential requirements or resulting in a modification of the intended purpose; a person who substantially modifies a product becomes its manufacturer. Art. 3(30), Art. 22 EUR-Lex ↩
- F-010 Excluded: medical devices (Regulation (EU) 2017/745) and in vitro diagnostics (2017/746) and motor-vehicle type-approved products (2019/2144) (Art. 2(2)); civil aviation products certified under Regulation (EU) 2018/1139 (Art. 2(3)); marine equipment under Directive 2014/90/EU (Art. 2(4)); spare parts made to identical specifications (Art. 2(6)); products developed or modified exclusively for national security or defence, or designed exclusively to process classified information (Art. 2(7)). Art. 2(2)–(4), (6)–(7) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.