For software companies
Not every software product falls under CRA. The key distinction is between pure SaaS — excluded from the regulation — and software delivered as a standalone product.
A software product falls under CRA if it is delivered independently of a cloud service — meaning the customer installs it on their own system (on-premise, embedded, plug-in for equipment). Mobile applications may be in scope if they contain components with active network functions.
Pure SaaS — where all processing occurs on the provider's servers and the user accesses the service via browser or API — is excluded from CRA's scope. However, NIS2 and GDPR remain applicable regardless of the delivery model.
If you are unsure where your product stands, our CRA Checker will guide you in minutes. If the answer is ambiguous, we recommend a professional assessment before September 2026.