EU Cyber Resilience Act

Not on its own. The CRA regulates products with digital elements placed on the market, and a pure cloud service delivered without any product is generally addressed by NIS2 rather than the CRA. The catch is the definition in Article 3: a product with digital elements includes its remote data processing solutions, meaning data processing at a distance that the manufacturer designed and developed and without which the product would not perform its functions. A connected device with a companion cloud backend is therefore in scope together with that backend. The scoping question worth answering first is not whether you sell software or a service, but whether any part of what you sell is placed on the EU market as a product.

Annex I Part II point 1 requires manufacturers to identify and document vulnerabilities and components contained in the product, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies. Two details matter in practice. The floor is top-level dependencies, not the full transitive graph, though most teams generate the full graph anyway because their tooling does. And the SBOM is documentation the manufacturer holds and provides to market surveillance authorities on request, not a file you are obliged to publish to the world.

The reporting duties come first. Article 14, which requires reporting actively exploited vulnerabilities and severe incidents affecting product security, applies from September 11, 2026. Chapter IV, covering notification of conformity assessment bodies, applies from June 11, 2026. The main obligations, including the Annex I essential requirements and conformity assessment, apply from December 11, 2027. The transitional rule in Article 69 is the one to read carefully: products placed on the market before December 11, 2027 only have to meet the full requirements if they are substantially modified after that date, but Article 69(3) applies the Article 14 reporting duties to every in-scope product already on the market.

It depends on the product class and on whether harmonized standards exist and are applied in full. Default products with digital elements can use internal control, which is self-assessment. Annex III class I important products can also self-assess where the manufacturer applies harmonized standards or a relevant European cybersecurity certification scheme in full; where it does not, Article 32 pushes it to an EU-type examination or a full quality assurance route involving a notified body. Class II important products always go through a third-party route or a certification scheme at substantial assurance level, and Annex IV critical products can be pushed toward European cybersecurity certification. Since the harmonized standards are still being developed, class I planning should assume the third-party route is possible rather than assuming it is not.

Article 64 sets three tiers. Non-compliance with the Annex I essential requirements or the Article 13 and 14 manufacturer obligations carries administrative fines up to 15 million euro or 2.5 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. A second tier covering most other operator obligations tops out at 10 million euro or 2 percent. Supplying incorrect, incomplete, or misleading information to notified bodies or market surveillance authorities tops out at 5 million euro or 1 percent. The commercial risk usually arrives before the regulatory one: a product that cannot be CE marked cannot be sold in the EU at all.