Does the EU Cyber Resilience Act apply to my mobile app?
Short answer (it depends): Commercially distributed apps installed on users’ phones are typically products with digital elements (PDEs). The app you ship is the focus; your purely server-side backend is generally treated as a remote data processing solution only where it’s needed for the app to function.
What it means for a mobile app
- App-store distribution to EU users counts as making available on the EU market.
- Free apps funded by ads, in-app purchases or data monetisation can still be commercial activity.
- The backend your app needs to work can be part of the product’s scope as remote data processing.
- White-label apps: whoever puts their name on it is usually the manufacturer.
Key dates
- 11 Sep 2026: reporting of actively exploited vulnerabilities and severe incidents (ENISA Single Reporting Platform) — applies to products already on the market.
- 11 Dec 2027: main obligations (security requirements, vulnerability handling, support period, CE marking).
FAQ
- I’m based outside the EU? Making your mobile app available to EU users can still bring you in scope.
- What docs would I need? Typically a CVD policy, security.txt, intake page, reporting runbook, support-period statement, risk assessment.
Related: 24h reporting for mobile apps
Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.
Last reviewed: 2026-10-30