Does the CRA apply to mobile apps?
Likely yes
Likely yes. An app is software, it connects to a network, and if you sell it or monetise it in the EU it is made available on the market in the course of a commercial activity — the Regulation's definition of a product with digital elements [[F-005]] [[F-007]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Made available on the EU market | Scope questions continue | Likely out of scope | F-101 |
| Supplied in the course of a commercial activity | Scope questions continue | Likely out of scope (or the open-source light regime) | F-007 |
| Has a direct or indirect connection to a device or network | It is a product with digital elements | Likely out of scope | F-005 |
| Product cannot perform a function without your own backend | That remote processing is part of the product | Only the installed part is the product | F-107 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Paid productivity app on both app stores, EU storefronts enabled
Likely in scope · role: _
The app is installed software with a network connection, sold in the EU: a product with digital elements made available in the course of a commercial activity.
Deciding fact: Art. 3(1), Art. 2(1)
-
Ad-funded app whose features run on your own API
Likely in scope · role: _ · remote processing in scope
Ad-funded or subscription apps are commercial. Because the app cannot perform its functions without your backend, that remote processing is part of the product too.
Deciding fact: Art. 3(1), Art. 2(1)
-
Weekend project, no ads, no charge, no paid support
Likely out of scope · role: _
Nothing is charged or monetised, so the app is not supplied in the course of a commercial activity and is not made available on the market.
Deciding fact: Art. 2(1), Art. 3(22), Recitals
-
Not sure whether EU users can download it
It depends on one fact · role: _
Availability on the EU market is the first fact the Regulation turns on. Check your storefront country list; the answer is then likely yes.
Deciding facts: Art. 3(1), Art. 2(1); Art. 3(22)
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
Why a mobile app is a product with digital elements
The Regulation covers software or hardware products and their remote data processing solutions, including components placed on the market separately [1]. A mobile app is software. Its intended use almost always includes a data connection to the phone it runs on and to a network: store downloads, updates, sync, accounts or any online feature meet the direct-or-indirect connection element [1]. The remaining question is commercial activity, not the technology.
What "commercial" means for an app
Charging a price is the obvious case, but the Regulation reads commercial activity more widely: charging for support, monetising through advertising or data, or otherwise intending to monetise all count as making it available in the course of a commercial activity [2]. A free download with in-app purchases or an ad SDK is commercial. The genuinely non-commercial case is the hobby app with no monetisation at all, which is not placed on the market [2].
When your backend joins the product
Many apps are thin clients. Where the app is designed to depend on your own remote data processing, and a function stops working without it, that remote processing is part of the product with digital elements [3] [4]. The scope check asks this directly rather than assuming it.
Open source
A free and open-source app that is not monetised is not considered placed on the market, and an organisation that systematically supports its development may fall under the lighter open-source steward regime instead [5]. A paid or ad-funded build of an open-source app is commercial again.
Timing
For a product first placed on the EU market on or after 11 December 2027, the Regulation applies in full from that date [6]. Article 14 reporting obligations have applied since 11 September 2026 to apps on the market, including apps placed on the market before December 2027 [7] [8]. Run the check with your own launch date to see both clocks.
Timing
Article 14 reporting applies from 2026-09-11; full requirements and CE marking apply from 2027-12-11. Dates come from the Facts Table entries cited below, evaluated for the first example; run the check for your own product's dates.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-006 Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Art. 3(2) EUR-Lex ↩
- F-107 Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII EUR-Lex ↩
- F-009 Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19 EUR-Lex ↩
- F-003 The Regulation applies in full from 11 December 2027. Art. 71(2) EUR-Lex ↩
- F-002 Article 14 (reporting obligations of manufacturers) applies from 11 September 2026. Art. 71(2) EUR-Lex ↩
- F-004 Products placed on the market before 11 December 2027 are subject to the Regulation only if substantially modified after that date; Article 14 applies to them regardless. Art. 69(2)–(3) EUR-Lex ↩
- F-101 Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.