Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

The CRA and SaaS: when cloud software is in scope

6 min read

On this page
  1. The rule: pure SaaS is out
  2. The exception: remote data processing
  3. Examples
  4. What it means in practice
  5. A quick test
  6. How Provetry helps
  7. Sources

“We are a SaaS company, so the Cyber Resilience Act does not apply to us.” Often true, sometimes not. The CRA is about products placed on the market; software offered only as a service is generally outside it. But the cloud part of a product is treated as part of that product, and many companies that think of themselves as SaaS also ship something: an app, an agent, a device.

The rule: pure SaaS is out

The CRA covers products with digital elements made available on the market. Software accessed only as a service over the network is not “made available on the market” in that sense, and the recitals confirm that the regulation does not cover SaaS as such. The security of those services is the subject of the NIS2 Directive, which covers cloud computing service providers and many digital service providers as entities.

The exception: remote data processing

The CRA defines remote data processing as data processing at a distance for which the software is designed and developed by the manufacturer, or under its responsibility, and the absence of which would prevent the product from performing one of its functions.

Remote data processing that meets that definition is part of the product. It must meet the essential requirements of Annex I, appear in the risk assessment and the technical documentation, and its vulnerabilities and incidents count for reporting.

Two conditions, both needed:

  1. You design it or are responsible for it. A third-party service the user chooses independently is not your remote data processing.
  2. The product cannot perform a function without it. If a function of the device or app stops working when your back end is down, the back end is in.

Examples

Situation In the CRA’s scope?
A web application used only in the browser, sold by subscription No: SaaS. NIS2 may apply to the company
A smart camera whose remote viewing goes through the maker’s cloud Yes: the cloud service is remote data processing of the camera
A mobile app sold or distributed in the EU, with its own API back end The app is a product; its API is remote data processing if the app’s functions depend on it
A desktop application that checks licences and syncs settings through the maker’s servers The application is a product; the sync service is remote data processing; a licence server may be too, if the application cannot work without it
A SaaS platform that also distributes an on-premises agent or a CLI The agent or CLI is a product; the platform behind it is in scope as far as the agent’s functions depend on it
A website showing documentation for a product No: the product does not need it to perform its functions
A device that sends data to a cloud the customer chooses and runs The device is in; the customer’s cloud is not the maker’s remote data processing

What it means in practice

If you have remote data processing:

  • include the back end in the risk assessment of the product, and in the security properties of Annex I (access control, encryption, availability, logging);
  • include its components in your SBOM approach, or at least in your vulnerability handling;
  • treat severe incidents on the back end that affect the product’s security as reportable under Article 14;
  • keep the back end supported for the product’s support period: shutting it down early can break the product’s functions and its security updates.

If you are pure SaaS, check NIS2 instead: depending on your sector and size, you may be an essential or important entity with your own risk-management and incident-reporting duties. See the CRA and NIS2.

A quick test

Ask three questions:

  1. Do we give customers anything that runs on their side: an app, an agent, firmware, a library, a CLI? If yes, that is a product.
  2. Does it need our servers to perform one of its functions? If yes, those servers are remote data processing of that product.
  3. If we only offer a service in the browser, are we an entity under NIS2?

Our free check asks these questions for each product and tells you which obligations apply.

How Provetry helps

When you describe a product, you say what it is (software, mobile application, firmware, connected device, component); the compliance dossier (Pro and Consultant plans) then walks through the Annex I questions, where you can describe the back end your product relies on.

This guide is general information, not legal advice.

Sources