Does the EU Cyber Resilience Act apply to my SaaS product with an app?

Short answer (it depends): Pure SaaS is mostly outside the CRA (it may fall under NIS2), but the installable client, agent, CLI or browser extension you ship is a PDE, and the cloud may count as its remote data processing.

What it means for a SaaS product with an app

• Web-only SaaS with no installable component: usually not a PDE.
• Desktop/mobile clients, on-prem agents, SDKs and CLIs: likely PDEs.
• The backend needed for the client to function can be in scope as remote data processing.
• Check NIS2 separately for the service side.

Key dates

• 11 Sep 2026: reporting of actively exploited vulnerabilities and severe incidents (ENISA Single Reporting Platform) — applies to products already on the market.
• 11 Dec 2027: main obligations (security requirements, vulnerability handling, support period, CE marking).

FAQ

• I’m based outside the EU? Making your SaaS product with an app available to EU users can still bring you in scope.
• What docs would I need? Typically a CVD policy, security.txt, intake page, reporting runbook, support-period statement, risk assessment.

Related: 24h reporting for SaaS products with apps

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30