Does the CRA cover my product's backend?
Likely yes
Likely yes for the backend too. Remote data processing designed and developed by the manufacturer, or under their responsibility, without which the product could not perform one of its functions, is part of the product with digital elements [[F-006]] [[F-107]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Product cannot perform a function without your own backend | That remote processing is part of the product | Only the installed part is the product | F-107 |
| Backend designed and developed by you or under your responsibility | It can be remote data processing | A third-party service is a supplier, not part of the product | F-006 |
| No installed component at all | Cloud service outside the Regulation | Product plus backend | F-008 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Mobile app whose core features run on your API
Likely in scope · role: _ · remote processing in scope
The app is a product and, because it cannot perform its functions without your backend, that remote processing is part of the product.
Deciding fact: Art. 3(1), Art. 2(1)
-
Desktop app with optional cloud backup, works fully offline
Likely in scope · role: _
The installed app is in scope; the optional backup service is not essential, so it is not part of the product for this reading.
Deciding fact: Art. 3(1), Art. 2(1)
-
Web dashboard only, nothing installed
Likely out of scope · role: _
A cloud service that is not part of a product is outside this Regulation and which may fall under NIS2.
Deciding fact: Art. 3(1)–(2), Recitals
-
Not sure whether the sync service is essential
It depends on one fact · role: _
Delivery and essentiality decide. Establish whether a product function stops without the backend; the result then resolves.
Deciding facts: Art. 3(1), Art. 2(1); Art. 3(2); Art. 3(1)–(2), Recitals
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
The definition of remote data processing
Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under the manufacturer's responsibility, and without which the product with digital elements could not perform one of its functions [1]. A product with digital elements expressly includes its remote data processing solutions [2].
Two questions
Did you design the backend for this product, or is it run under your responsibility [1]? Would a product function stop working without it [1]? Two yeses, and the backend is part of the product and covered by the same essential requirements and documentation as the installed part [3].
What is not part of the product
A third-party service you merely call is a supplier relationship, not remote data processing designed by you [1]. An optional convenience feature that the product works without is not essential in the Regulation's sense [1]. And a cloud service with no product at all is outside the Regulation and which may fall under NIS2 [4] [5].
Shared backends
A backend that serves several of your products is part of each product it is essential to [3]. The scope check asks the question per product.
Timing
Article 14 reporting applies from 2026-09-11; full requirements and CE marking apply from 2027-12-11. Dates come from the Facts Table entries cited below, evaluated for the first example; run the check for your own product's dates.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-006 Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Art. 3(2) EUR-Lex ↩
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-107 Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII EUR-Lex ↩
- F-008 Cloud services that are not part of a product are outside the Regulation (they fall under NIS2); remote data processing essential to a product is within scope as part of that product. Art. 3(1)–(2), Recitals EUR-Lex ↩
- F-103 Cloud services may fall under NIS2 (Directive (EU) 2022/2555) rather than the CRA. NIS2 EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.