Remote Data Processing Solution: The CRA's SaaS Boundary
How the Cyber Resilience Act defines remote data processing solutions, and when a cloud service becomes part of a regulated product.
A remote data processing solution is data processing at a distance whose software is designed and developed by or on behalf of the manufacturer, and without which the product with digital elements could not perform one of its functions. Article 3(2) defines the remote data processing itself, and Article 3(1) makes such solutions part of the product with digital elements.
This definition draws the boundary between the CRA and pure SaaS: cloud services as such are not products with digital elements under the CRA, though NIS2 or DORA may cover them depending on the provider’s sector and size. But if a cloud component is necessary for a shipped product to perform one of its functions, for example a companion backend without which a device or application cannot work, that component counts as part of the product and falls within CRA scope together with it. Optional cloud features that merely extend a product do not meet the definition.
Vendors offering both a SaaS service and a self-hosted edition should note that the self-hosted edition is a product in its own right, independent of this definition. Work through the CRA scope decision tree to see where your products land.
