CRA product classification
Is a Pure SaaS / cloud service covered by the EU Cyber Resilience Act?
Based on the starter data, Pure SaaS / cloud service may be excluded from the CRA as identified below. Confirm that the product meets the legal exclusion and is not supplied as a different in-scope product. Applicable obligations and assessment routes depend on the full product context; reporting begins 11 September 2026 and general application begins 11 December 2027.
Why this category?
A pure SaaS service may be outside scope; remote data processing for a product may be treated differently.
This classification is marked likely. TODO(owner): verify the current Commission technical description and borderline treatment before launch.
Borderline cases
- Does the service perform remote data processing for a product with digital elements?
What you may need to do
The product type is not classified to an Annex III or IV assessment route by the current starter data. Confirm the correct category before selecting a route.
Top Annex I items to assess
- Vulnerability handling and no known exploitable vulnerabilities at placing on the market (Annex I)
- Secure-by-default configuration and updates (Annex I)
- Access control, confidentiality and integrity (Annex I)
- Attack-surface management and security logging (Annex I)
- SBOM, coordinated disclosure and secure update distribution (Annex I, Part II)
What applies today?
CRA Article 14 reporting obligations apply from 11 September 2026 to in-scope products already on the market as well as new products. See the Article 14 reporting tool.
Frequently asked questions
Is a Pure SaaS / cloud service covered by the EU Cyber Resilience Act?
The CRA may apply to a Pure SaaS / cloud service placed on the EU market as a product with digital elements, subject to the scope and exclusions. This preliminary page associates it with the default category; confirm its intended purpose and technical characteristics.
What conformity route applies to a Pure SaaS / cloud service?
The route depends on the final CRA category and applicable conformity-assessment requirements. Important and critical categories can require third-party assessment or an EU cybersecurity certification scheme.
When do the CRA requirements apply?
Reporting obligations apply from 11 September 2026. The CRA's general application date is 11 December 2027. Transitional treatment for products already placed on the market depends on the facts and substantial modification.