When Is the Cloud Part of Your Product Under the CRA?
Updated 20 September 20262 min read
Most connected products depend on a backend: an API behind the app, a device cloud, a remote management service. The Cyber Resilience Act can pull that backend into scope as part of your product — or leave it out. The test is in Article 3.
The two definitions
Article 3(1): a product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately.
Article 3(2): remote data processing is data processing at a distance whose software is designed and developed by the manufacturer, or under its responsibility, and without which the product could not perform one of its functions.
The test, in two questions
- Is the backend software designed and developed by you, or under your responsibility?
- Without it, would the product be unable to perform one of its functions?
If the answer to both is yes, the backend is part of your product.
What recital 12 adds
- Cloud solutions count as remote data processing only if they meet that definition.
- In scope: cloud functionalities from a smart home device manufacturer that let users control the device at a distance. The Regulation uses exactly this example.
- Out of scope: websites that do not support the functionality of a product, and cloud services designed and developed outside the manufacturer's responsibility.
- Cloud computing services and models such as SaaS fall under NIS2, Directive (EU) 2022/2555.
How the test plays out
| Situation | Likely outcome |
|---|---|
| A thermostat controlled through the manufacturer's own cloud API | In scope — the textbook case of recital 12 |
| The backend a companion app cannot work without | In scope, as remote data processing |
| The product's marketing website | Out — it does not support a product function |
| The underlying platform of a third-party cloud provider, as opposed to your own backend code running on it | Out of the definition |
| Software sold only as an online service | Generally outside the CRA — NIS2 territory |
These are readings of the Article 3 test, not rulings. Edge cases deserve a documented decision.
Why it matters
Because the definition includes them, your remote data processing solutions are part of the product that the CRA's requirements apply to. In practice: - a vulnerability in that backend is a vulnerability in your product, so it falls under vulnerability handling and, if actively exploited, under the Article 14 reporting obligations; - your component inventory, security testing and support period planning should cover the backend as well as the device.
Sources
- Regulation (EU) 2024/2847, Article 3(1) and 3(2); recital 12 — Official Journal of the European Union
Position as at 20 September 2026. General information, not legal advice.