CEMarque

Does the Cyber Resilience Act apply to games?

Last verified 3 September 2026 · Facts v2026.09.2

Yes, for a commercially released game with any network capability. A game distributed on Steam, a console store or a mobile store is installed software that connects to a network, and it is sold, which makes it a product with digital elements supplied in the course of a commercial activity [1] [2].

Genuinely offline single-player games with no network interfaces at all are the exception, and they are increasingly rare [1].

Your online services are part of the game

If the game needs your servers for matchmaking, saves, accounts or anti-cheat, those services are remote data processing without which the product cannot perform a function, and they are part of the product [3]. A studio cannot scope out its backend by treating it as separate infrastructure [3].

Applies to you if

  • You publish a paid game, or a free-to-play game with purchases or advertising [2].
  • The game has multiplayer, leaderboards, cloud saves, or an account system [3].
  • You ship post-release patches through a store or your own launcher [1].

The three parts studios find hardest

The support period. You must determine a support period reflecting how long the product is expected to be in use, and it is at least five years unless the product is expected to be in use for less [4]. Games have long tails and studios move on to the next title, so this is a commercial commitment as much as a technical one, and it has to be decided rather than left implicit [4].

Automatic security updates. For consumer products, security updates are installed automatically by default, with a clear and easy-to-use way for the user to opt out [5]. Most games already patch through a store, so the mechanism exists; what is new is that the default and the opt-out both have to be right [5].

The back catalogue. A game already on the market before full application does not need CE marking until it is substantially modified, but the reporting duty applies to it anyway [6]. A live-service title that keeps shipping content is a harder case than an archived one, because content updates raise the question of what counts as a substantial modification [6].

The two dates

Reporting applies from 11 September 2026: an actively exploited vulnerability in your game, or a severe incident affecting its security, has to be reported starting with an early warning within 24 hours of awareness [7].

Full application, including CE marking and technical documentation, is from 11 December 2027 [8].

What to do next

Decide the support period for your current title before someone else decides it for you, and write it into the product information you already publish [4]. Then work out who, at 2am on a Saturday during a live incident, is empowered to say "this is an actively exploited vulnerability" and start the 24-hour clock [7].

What to do next

Run your own product through the checker — it takes under a minute and gives you a dated, citable result you can send to a customer.

Check my product

Sources

  1. A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) — EUR-Lex ↩
  2. The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals — EUR-Lex ↩
  3. Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII — EUR-Lex ↩
  4. Support period: determined by the manufacturer to reflect the expected use time; at least five years unless the product is expected to be in use for less; the end date (month and year) is stated at purchase. A security update, once issued, remains available for at least ten years or the remainder of the support period, whichever is longer. Art. 13(8), (10), (25) — EUR-Lex ↩
  5. Security updates are installed automatically by default for consumer products, with a clear and easy-to-use opt-out mechanism. Annex I Part I(2)(c) — EUR-Lex ↩
  6. Products placed on the market before 11 December 2027 are subject to the Regulation only if substantially modified after that date; Article 14 applies to them regardless. Art. 69(2)–(3) — EUR-Lex ↩
  7. Article 14 (reporting obligations of manufacturers) applies from 11 September 2026. Art. 71(3) — EUR-Lex ↩
  8. The Regulation applies in full from 11 December 2027. Art. 71(2) — EUR-Lex ↩

Related

  • Does the EU Cyber Resilience Act apply to my mobile app?

    Yes, in almost every case. An installed app that connects to anything is a product with digital elements, and publishing it in an EU app store makes it available on the EU market.

  • Does the CRA apply to free or ad-supported apps?

    Charging nothing does not put you outside the Regulation. What matters is whether the product is supplied in the course of a commercial activity, and advertising, data and freemium funnels all count.

  • Does the CRA apply to browser extensions?

    Yes, if it is monetised. An extension is installed software that connects to a network. The class question matters here: browsers are listed as important products, and extensions are not the browser.

  • Does the CRA apply to WordPress plugins and themes?

    A paid or freemium plugin is a product with digital elements and is in scope. A genuinely non-monetised free plugin is not. Agencies that ship client sites under their own name are manufacturers of what they ship.

CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 3 September 2026 (Facts v2026.09.2). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.