Does the CRA apply to SDKs and libraries?
Likely yes
Likely yes when supplied commercially. The definition expressly includes software components placed on the market separately, and an SDK or library is such a component [[F-005]]. Free open-source libraries that are not monetised are not placed on the market [[F-009]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Made available on the EU market | Scope questions continue | Likely out of scope | F-101 |
| Supplied in the course of a commercial activity | Scope questions continue | Likely out of scope (or the open-source light regime) | F-007 |
| Placed on the market separately from a finished product | It is a component product in its own right | The integrator is responsible for it | F-005 |
| Free and open-source, not monetised | Not placed on the market; the steward light regime may apply | Normal manufacturer scope | F-009 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Commercial payments SDK licensed to EU app developers
Likely in scope · role: _
A software component placed on the market separately, supplied in the course of a commercial activity: a product with digital elements.
Deciding fact: Art. 3(1), Art. 2(1)
-
MIT-licensed library maintained by a foundation, no paid tier
Open-source light regime may apply · role: _
Free and open-source software that is not monetised is not considered placed on the market; the foundation may be an open-source software steward under the light regime.
Deciding fact: Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19
-
Dual-licensed library: free open-source core, paid commercial licence
Likely in scope · role: _
The commercial licence is a commercial activity; the same code base is placed on the market under it.
Deciding fact: Art. 3(1), Art. 2(1)
-
Not sure whether the SDK reaches EU developers
It depends on one fact · role: _
EU availability decides. If EU developers can obtain it, it is made available on the EU market.
Deciding facts: Art. 3(1), Art. 2(1); Art. 3(22)
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
Components are products
The definition of a product with digital elements includes software or hardware components placed on the market separately [1]. An SDK, a library or a binary module supplied on its own is therefore a product in its own right, with its own manufacturer, provided it is supplied in the course of a commercial activity [2].
Who is responsible for what
A developer who integrates a component into their own product is the manufacturer of that product and responsible for its conformity, including the integrated component [3]. The component's own manufacturer is responsible for the component as placed on the market [1]. Both are true at once; the scope check answers only whether the Regulation applies to the component you supply.
Open source and dual licensing
Free and open-source software that is not monetised is not considered placed on the market, and stewards who systematically support such software fall under a lighter regime [4]. A dual-licensed library is commercial through its paid licence [2]. Monetisation or commercial redistribution by you changes a non-commercial verdict and should be re-checked when it happens [5].
Availability
Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity [6]. Commercial distribution through a package registry, a partner portal or a licence agreement each counts when EU customers can obtain it [6].
Timing
Article 14 reporting applies from 2026-09-11; full requirements and CE marking apply from 2027-12-11. Dates come from the Facts Table entries cited below, evaluated for the first example; run the check for your own product's dates.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-104 A developer who integrates a component into their own product is the manufacturer of that product and responsible for its conformity, including the integrated component. Art. 13(5), Art. 3(13) EUR-Lex ↩
- F-009 Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19 EUR-Lex ↩
- F-102 Monetisation or commercial redistribution by you changes a non-commercial verdict; re-check when that happens. Recitals EUR-Lex ↩
- F-101 Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.