Guides to how the CRA applies to specific products and models: SaaS and cloud backends, mobile apps, IoT devices, industrial products, enterprise software, security software in classes I and II, open-core companies and individual maintainers.
Whether a SaaS or cloud product falls under the CRA: browser-only web applications versus downloadable software, when a backend becomes remote data processing of a product, on-premises backends, what the CRA leaves to NIS 2, and examples from the Commission guidance.
How the CRA applies to mobile apps: apps as products with digital elements, which backend services count as remote data processing, the Commission's mobile banking example, build variants, update and support period duties.
What the CRA means for connected device makers: which consumer IoT categories are important products, secure defaults and reset, automatic updates, cloud functions as remote data processing, support periods, and the default self-assessment route.
How the CRA applies to industrial control and OT products: where automatic updates are not expected, longer support periods, threat models for critical infrastructure, availability after incidents, cloud-connected machinery, and network equipment classes.
How the CRA applies to software sold to businesses: the tailor-made exception for defaults and free updates, automatic updates in professional environments, fixing only the latest version, versions and variants, and the support period.
What the CRA requires of identity and access management, password manager, VPN, SIEM, PKI and similar vendors: class I categories, the technical descriptions, when module A is allowed, the open-source route, and the access control requirement itself.
How class II products such as firewalls, WAFs, intrusion detection systems, hypervisors and container runtimes reach conformity: mandatory third-party assessment, the technical descriptions, the open-source exception, notified body availability and cost.
How the CRA treats companies that publish open-source software and sell around it: community edition versus paid edition, paid support, monetizing other services, steward duties and their lighter regime, and the open-source conformity route.
Whether individual maintainers, contributors and foundations carry CRA obligations: who is responsible for a FOSS project, donations and sponsorship, not-for-profit organizations, foundations as stewards, and steward reporting from December 2027.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.