Does the EU Cyber Resilience Act apply to my SaaS?

Services delivered entirely from the provider's own infrastructure are generally not 'products with digital elements', so the CRA usually does not apply to pure SaaS. Exception: if you also ship client software (an app, agent, connector or browser extension), those installed components can fall in scope.

Does the CRA apply to free open-source software?

Non-monetised free open-source software falls outside the CRA. Monetised open source (charging for distribution, or selling support or licensing tied to the product itself) is treated like any other commercial product.

When do CRA obligations start?

The CRA applies from 11 December 2027. However, Article 14 vulnerability and incident reporting duties apply earlier, from 11 September 2026, and the Chapter IV notified-body framework (Articles 35 to 51) has applied since 11 June 2026.

Do I need CE marking for my software?

Once the CRA fully applies on 11 December 2027, in-scope manufacturers must affix CE marking visibly, legibly and indelibly, and draw up an EU declaration of conformity before placing a product on the EU market.

What is an SBOM and do I need one?

A software bill of materials is a machine-readable inventory of the components in your product. The CRA requires one covering at least the top-level dependencies, in a commonly used format such as CycloneDX or SPDX.

How long must I support my product under the CRA?

The support period must be at least five years, counted from when the product was last placed on the market, or the expected use time where the product is expected to be in use for less than five years. Security updates must be provided throughout.

I resell products: do I have CRA duties?

Yes. Distributors must act with due care: confirm CE marking and required documentation are present, and not make products available that they know or should know are non-compliant. Importers have additional verification and labelling duties.

What are the CRA fines?

Non-compliance with the essential cybersecurity requirements and the core manufacturer duties (Articles 13–14) is subject to administrative fines of up to EUR 15,000,000 or 2.5% of total worldwide annual turnover, whichever is higher. Breaches of importer and distributor obligations carry fines of up to EUR 10,000,000 or 2%.

Which conformity route will my product face?

Most products follow the default internal-control route (self-assessment). Products listed in Annex III Class I, such as browsers, password managers and network equipment, require full technical documentation and an EU declaration of conformity. Annex III Class II products, such as firewalls, IDS/IPS and hypervisors, and Annex IV critical products, such as hardware security boxes and smartcards, require third-party assessment by a notified body.

Is Cybiq legal advice?

No. Cybiq provides orientation based on Regulation (EU) 2024/2847 as published in the Official Journal. Every obligation cites verbatim Official Journal text so you can verify before relying on any item. For a binding legal assessment, consult a qualified lawyer.

Cybiq: Does the EU Cyber Resilience Act apply to your product?

What Cybiq checks

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for products with digital elements sold in the EU. Cybiq asks six questions (how your product reaches users, what customers receive, overlapping EU regimes, your supply-chain role, and the product category) and returns a definitive verdict: in scope or out, which conformity route applies (self-assessment, Annex III Class I documentation, or notified-body assessment), your concrete obligations, and the dates that matter.

Every claim is anchored word-for-word in the Official Journal (CELEX 32024R2847) and re-verified weekly by automated tests against the live text, fetched from the Publications Office CELLAR endpoint.

The dates that matter

Date	What starts
11 June 2026	Notified-body framework in application (Chapter IV, Articles 35 to 51): no operator duties yet, context for products that will need third-party assessment
11 September 2026	Manufacturers' vulnerability & incident reporting duties (Art. 14): early warning 24 h · notification 72 h · final report 1 month
11 December 2027	Full application: technical documentation, SBOM, support period, conformity assessment, CE marking

Non-compliance with essential requirements and Articles 13–14: fines up to €15,000,000 or 2.5% of worldwide turnover (Art. 64(2)). Operator obligations: up to €10,000,000 or 2% (Art. 64(3)).

Frequently asked questions

Does the CRA apply to my SaaS?: Generally no: services running entirely on your own infrastructure are not “products with digital elements”. But if you ship client software (an app, agent, connector), those installed parts can fall in scope.
What about free open-source software?: Non-monetised OSS falls outside the CRA. Monetised open source (paid distribution, or support/licensing tied to the product) is treated like any other commercial product.
When do my obligations start?: Main application is 11 December 2027. Art. 14 reporting duties (manufacturers only) start 11 September 2026; the Chapter IV notified-body framework has applied since 11 June 2026.
Do I need CE marking for my software?: Once the CRA fully applies (11 December 2027), in-scope manufacturers affix CE marking visibly, legibly and indelibly, plus an EU declaration of conformity.
What is an SBOM and do I need one?: A machine-readable inventory of your product's components. The CRA requires one covering at least the top-level dependencies, in a common format such as CycloneDX or SPDX.
How long must I support my product?: At least five years from last placing on the market, or the expected use time where the product is expected to be in use for less than five years; declared visibly, with security updates throughout.
I resell products: do I have duties?: Yes: act with due care, confirm CE marking and documentation are present, and don't supply products you know to be non-compliant. Importers carry additional verification and labelling duties.
What are the CRA fines?: Up to €15,000,000 or 2.5% of worldwide turnover for breaches of the essential requirements and Articles 13–14; up to €10,000,000 or 2% for importer/distributor obligations (Art. 64).
Which conformity route applies to my product?: Most products: internal control (self-assessment). Annex III Class I products (browsers, password managers, routers): self-assessment plus full technical documentation. Annex III Class II (firewalls, hypervisors) and Annex IV critical products (security boxes, smartcards): notified body required.
Is this legal advice?: No: orientation grounded in the Official Journal, with verbatim citations on every item so you can verify. For a binding assessment, consult a qualified lawyer.

More depth: the full FAQ (34 evidence-checked answers) and the CRA glossary with verbatim definitions.

Documents after the check

Verification checklist pack · €49: role-specific checklist for importers and distributors, plus their vulnerability-notification duties under Articles 19–20.
CRA compliance pack · €199: classification memo, vulnerability-handling procedure, SBOM policy, secure-by-default checklist, support-period statement, Annex V index.
Notified-body readiness pack · €299: everything above plus conformity-assessment preparation guide and regulatory-watch updates until December 2027.

Prices final; seller not VAT-registered (small-business exemption). Automated compliance documents, not legal advice.

About Cybiq

What Cybiq checks

The dates that matter

Frequently asked questions

Documents after the check