Does the CRA apply to WordPress plugins?
Likely yes
Likely yes for anything sold, freemium, or monetised. A plugin is software installed into a connected system, so it is a product with digital elements once it is supplied in the course of a commercial activity [[F-005]] [[F-007]]. Free open-source plugins that are not monetised are not placed on the market [[F-009]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Made available on the EU market | Scope questions continue | Likely out of scope | F-101 |
| Supplied in the course of a commercial activity | Scope questions continue | Likely out of scope (or the open-source light regime) | F-007 |
| Has a direct or indirect connection to a device or network | It is a product with digital elements | Likely out of scope | F-005 |
| Free and open-source, not monetised | Not placed on the market; the steward light regime may apply | Normal manufacturer scope | F-009 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Premium plugin sold with annual licence and support
Likely in scope · role: _
Sold, installed, connected: a product with digital elements made available in the course of a commercial activity.
Deciding fact: Art. 3(1), Art. 2(1)
-
Free directory plugin with a paid Pro add-on
Likely in scope · role: _
The free tier is the funnel for a paid product; the plugin is monetised, so it is commercial. Both tiers are the product you place on the market.
Deciding fact: Art. 3(1), Art. 2(1)
-
GPL plugin, no paid tier, maintained by a foundation
Open-source light regime may apply · role: _
Free and open-source software that is not monetised is not considered placed on the market; a body that systematically supports it may be an open-source steward under the light regime.
Deciding fact: Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19
-
Not sure whether sponsorship counts as monetisation
It depends on one fact · role: _
Commercial activity is the deciding fact. Regular charging for support or paid tiers is commercial; sponsorship of a non-monetised project is generally not.
Deciding facts: Art. 3(1), Art. 2(1); Art. 2(1), Art. 3(22), Recitals
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
A plugin is a product in its own right
The definition covers software products and components placed on the market separately [1]. A plugin is exactly that: a software component supplied separately from the platform it extends. It runs inside a web server that is connected to the internet, so the connection element is met [1].
The commercial line
The Regulation applies to products made available on the market in the course of a commercial activity, and that includes charging a price, charging for support, and monetising or intending to monetise the product otherwise [2]. A freemium plugin is generally commercial in both tiers, because the free tier is how the paid one is sold [2]. Selling only support is still commercial [2].
Open source
Free and open-source software that is not monetised is not considered placed on the market [3]. Legal persons who systematically support the development of such software, an open-source software steward, fall under a lighter, tailored regime rather than full manufacturer obligations [3]. Two consequences follow. A plugin listed on the public directory with no paid tier and no paid support is likely outside scope [3]. The moment the same plugin is monetised, or commercially redistributed by you, the verdict changes and should be re-checked [4].
Agencies and integrators
A developer who integrates a plugin into their own product is the manufacturer of that product and responsible for its conformity, including the integrated component [5]. Whether a plugin built for a single client is made available on the market is a fact question for the full check on CEMarque; a plugin the agency sells to many customers plainly is [6].
Timing
Article 14 reporting applies from 2026-09-11; full requirements and CE marking apply from 2027-12-11. Dates come from the Facts Table entries cited below, evaluated for the first example; run the check for your own product's dates.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-009 Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19 EUR-Lex ↩
- F-102 Monetisation or commercial redistribution by you changes a non-commercial verdict; re-check when that happens. Recitals EUR-Lex ↩
- F-104 A developer who integrates a component into their own product is the manufacturer of that product and responsible for its conformity, including the integrated component. Art. 13(5), Art. 3(13) EUR-Lex ↩
- F-101 Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.