Does the CRA apply to free or ad-supported apps?
Yes, if there is any commercial activity behind it. Price is not the test. The Regulation covers products made available on the market in the course of a commercial activity, and charging a price is only one of several ways that test is met [1].
What counts as commercial
Advertising revenue counts. So does monetising user data, charging for support, offering a free tier that funnels into a paid one, and shipping free software as part of something else you sell [1]. In each case the product is supplied for distribution or use on the EU market in the course of a business, which is what "made available" means [2].
What does not
A genuinely non-monetised hobby project is not placed on the market at all, and free and open-source software that is not monetised is treated the same way [3]. That is a real exemption, not a loophole to be argued around, but it is narrower than it first looks: the moment you add a paid tier, take sponsorship tied to the product, or bundle it into a commercial offering, the answer changes [4].
There is also a middle category. Open-source software stewards — legal persons that systematically support the development of open-source products intended for commercial use — have their own lighter set of obligations rather than a full exemption [3].
Applies to you if
- Your app is free to download but shows advertising [1].
- Your app is free but there is a paid tier, a paid companion product, or paid support [1].
- You give the software away and monetise the data it produces [1].
- You are a company and the free product exists to sell something else [2].
The common mistake
Teams reason from the wrong noun. They ask whether the app is commercial, when the test is whether it is supplied in the course of a commercial activity [1]. A company's free developer tool, published to build goodwill for a paid platform, is supplied in the course of a commercial activity even though nobody pays for it.
The mirror-image mistake is assuming that anything with a licence file is exempt. The open-source exemption turns on monetisation and on how the software reaches users, not on the licence [3].
What to do if you are unsure
Write down, in one sentence, how the product relates to money in your organisation. If that sentence contains a revenue stream of any kind — including one that is a step removed, like advertising or lead generation — assume you are in scope and act accordingly [1]. If it genuinely does not, record why, and re-check the moment that changes [4].
It costs very little to be wrong in the cautious direction here. Reporting readiness — a monitored contact address and a decision path for actively exploited vulnerabilities — is worth having regardless, and it is the obligation that arrives first [5]. Being wrong in the other direction means discovering an obligation you have already missed.
What to do next
Run your own product through the checker — it takes under a minute and gives you a dated, citable result you can send to a customer.
Sources
- The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals — EUR-Lex ↩
- Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) — EUR-Lex ↩
- Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Recitals — EUR-Lex ↩
- Monetisation or commercial redistribution by you changes a non-commercial verdict; re-check when that happens. Recitals — EUR-Lex ↩
- Article 14 (reporting obligations of manufacturers) applies from 11 September 2026. Art. 71(3) — EUR-Lex ↩
Related
- Does the EU Cyber Resilience Act apply to my mobile app?
Yes, in almost every case. An installed app that connects to anything is a product with digital elements, and publishing it in an EU app store makes it available on the EU market.
- Does the CRA apply to open-source software I maintain?
Unmonetised open source is not placed on the market and is outside the Regulation. Stewards who systematically support commercial-use projects have a lighter regime. Companies that integrate your code are manufacturers of their products.
- Does the CRA apply to browser extensions?
Yes, if it is monetised. An extension is installed software that connects to a network. The class question matters here: browsers are listed as important products, and extensions are not the browser.
- Does the CRA apply to games?
Yes for a commercially published game with any online component. The awkward parts for studios are the support period, automatic security updates for consumer products, and games that are already shipped.
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 3 September 2026 (Facts v2026.09.2). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.