CRA facts

Short answers to the questions makers actually ask, with the Article beside every claim. 10 pages, all citing Facts v2026.09.2.

All pages

• Does the EU Cyber Resilience Act apply to my mobile app?

  Yes, in almost every case. An installed app that connects to anything is a product with digital elements, and publishing it in an EU app store makes it available on the EU market.

• Does the CRA apply to browser extensions?

  Yes, if it is monetised. An extension is installed software that connects to a network. The class question matters here: browsers are listed as important products, and extensions are not the browser.

• What must I do by 11 December 2027?

  Everything else. From full application a product placed on the EU market needs a completed technical file, an EU declaration of conformity you sign, CE marking, a stated support period and a software bill of materials.

• What must I do by 11 September 2026?

  Be able to report. From that date manufacturers must notify actively exploited vulnerabilities and severe incidents through the ENISA platform, with an early warning within 24 hours of becoming aware.

• Does the CRA apply to free or ad-supported apps?

  Charging nothing does not put you outside the Regulation. What matters is whether the product is supplied in the course of a commercial activity, and advertising, data and freemium funnels all count.

• Does the CRA apply to games?

  Yes for a commercially published game with any online component. The awkward parts for studios are the support period, automatic security updates for consumer products, and games that are already shipped.

• Does the CRA apply to open-source software I maintain?

  Unmonetised open source is not placed on the market and is outside the Regulation. Stewards who systematically support commercial-use projects have a lighter regime. Companies that integrate your code are manufacturers of their products.

• What is a product with digital elements under the CRA?

  A software or hardware product and its remote data processing solutions, including components placed on the market separately. The phrase is broad on purpose and the remote-processing half is the part people miss.

• Is SaaS in scope of the CRA?

  A pure cloud service is generally outside the CRA and falls under NIS2 instead. But a backend your own installed product cannot function without is part of that product, and is in scope with it.

• Does the CRA apply to WordPress plugins and themes?

  A paid or freemium plugin is a product with digital elements and is in scope. A genuinely non-monetised free plugin is not. Agencies that ship client sites under their own name are manufacturers of what they ship.

Everyone

• What must I do by 11 December 2027?
• What must I do by 11 September 2026?
• Does the CRA apply to free or ad-supported apps?
• Does the CRA apply to open-source software I maintain?
• What is a product with digital elements under the CRA?
• Is SaaS in scope of the CRA?

Browser extensions

• Does the CRA apply to browser extensions?
• Does the CRA apply to free or ad-supported apps?

Desktop apps

• Does the CRA apply to free or ad-supported apps?

Developer tools

• Does the CRA apply to open-source software I maintain?

Games

• Does the CRA apply to free or ad-supported apps?
• Does the CRA apply to games?

Mobile apps

• Does the EU Cyber Resilience Act apply to my mobile app?
• Does the CRA apply to free or ad-supported apps?

Plugins and themes

• Does the CRA apply to open-source software I maintain?
• Does the CRA apply to WordPress plugins and themes?

SDKs and libraries

• Does the CRA apply to open-source software I maintain?

Web apps with an installed component

• Is SaaS in scope of the CRA?

CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 3 September 2026 (Facts v2026.09.2). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.