Product with Digital Elements: The CRA's Core Definition
What counts as a product with digital elements under the Cyber Resilience Act, and why standalone software qualifies on its own.
A product with digital elements is any software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately, as defined in Article 3(1) of the Cyber Resilience Act. The definition is the entry point to the entire regulation: everything the CRA requires attaches to products that meet it and are made available on the EU market in the course of a commercial activity.
Software qualifies on its own, without any hardware: self-hosted server applications, on-prem agents, installers, desktop clients, mobile apps, and standalone components such as libraries are all products with digital elements when supplied commercially. Pure cloud services are not covered, unless they qualify as a remote data processing solution belonging to a product. Non-commercial open-source software is also out of scope.
For products meeting the definition, the CRA’s essential requirements, support-period obligations, and, from December 11, 2027, conformity assessment and CE marking apply. Start with does the CRA apply to your company to classify your own products.
