Is a browser-only web app in scope of the CRA?
Likely no
Likely no. A web application with no installed component, no device and no downloadable client is not a product with digital elements, and cloud services that are not part of a product are outside the Regulation and which may fall under NIS2 [[F-005]] [[F-008]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Any installed component, device or downloadable client | Product with digital elements | Cloud service outside the Regulation | F-005 |
| Cloud service not part of a product | Outside; NIS2 may apply | In scope with the product | F-008 |
| Product cannot perform a function without your own backend | That remote processing is part of the product | Only the installed part is the product | F-107 |
| Supplied in the course of a commercial activity | Scope questions continue | Likely out of scope (or the open-source light regime) | F-007 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Browser-only project management SaaS
Likely out of scope · role: _
Nothing is installed and there is no device, so there is no product with digital elements; the service is outside this Regulation; NIS2 may apply instead.
Deciding fact: Art. 3(1)–(2), Recitals
-
Same SaaS with a desktop client that cannot work without it
Likely in scope · role: _ · remote processing in scope
The desktop client is a product with digital elements, and the service it depends on is part of it.
Deciding fact: Art. 3(1), Art. 2(1)
-
Same SaaS with a browser extension that is optional
Likely in scope · role: _
The extension is installed software supplied commercially and is a product with digital elements in its own right.
Deciding fact: Art. 3(1), Art. 2(1)
-
Not sure whether the mobile wrapper app counts as installed
It depends on one fact · role: _
Delivery form is the deciding fact. A wrapper app installed from a store is an installed component; answer accordingly and the result resolves.
Deciding facts: Art. 3(1), Art. 2(1); Art. 3(2); Art. 3(1)–(2), Recitals
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
No product, no product regulation
A product with digital elements is a software or hardware product, with its remote data processing solutions, that has a direct or indirect connection to a device or network [1]. Where customers use your service only through their own browser, you supply no software product to them. Cloud services that are not part of a product are outside this Regulation and may fall under NIS2 instead [2] [3].
The moment it changes
The picture changes when anything of yours is installed or shipped: a desktop client, a mobile app, a browser extension, an agent or a device [1]. That part is a product with digital elements, and where it cannot perform a function without your backend, the backend is remote data processing that is part of the product [4] [5]. Adding such a component is a re-check moment [6].
Why the distinction matters
The two regimes impose different kinds of obligation, so assuming the cautious answer puts effort into the wrong one [2] [3]. Establish the fact instead.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-008 Cloud services that are not part of a product are outside the Regulation (they fall under NIS2); remote data processing essential to a product is within scope as part of that product. Art. 3(1)–(2), Recitals EUR-Lex ↩
- F-103 Cloud services may fall under NIS2 (Directive (EU) 2022/2555) rather than the CRA. NIS2 EUR-Lex ↩
- F-006 Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Art. 3(2) EUR-Lex ↩
- F-107 Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII EUR-Lex ↩
- F-102 Monetisation or commercial redistribution by you changes a non-commercial verdict; re-check when that happens. Recitals EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.