CRA guidance · Published 2026-08-04
Does the Cyber Resilience Act apply to SaaS?
Start with the product and its functions, not the hosting label.
What this guide covers
- Identify what software or hardware the customer receives
- Examine whether remote processing is necessary for a product function
- Record the market route, responsible operator, exclusions and assumptions
This article provides general information about the EU Cyber Resilience Act. It is not legal advice.