Does the EU Cyber Resilience Act apply to my desktop app?
Short answer (it depends): Installable desktop software sold or monetised in the EU is a classic PDE. Paid licences, freemium tiers and bundled commercial support all point toward commercial activity.
What it means for a desktop app
- Installers, auto-updaters and plugins you ship are part of what you place on the market.
- Paid licences or subscriptions = commercial activity; a donation-only hobby tool may differ.
- Auto-update channels help you meet security-update duties, but must be secured themselves.
- Internal-only tools never made available on the market are generally out.
Key dates
- 11 Sep 2026: reporting of actively exploited vulnerabilities and severe incidents (ENISA Single Reporting Platform) — applies to products already on the market.
- 11 Dec 2027: main obligations (security requirements, vulnerability handling, support period, CE marking).
FAQ
- I’m based outside the EU? Making your desktop app available to EU users can still bring you in scope.
- What docs would I need? Typically a CVD policy, security.txt, intake page, reporting runbook, support-period statement, risk assessment.
Related: 24h reporting for desktop apps
Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.
Last reviewed: 2026-10-30