normakte / CRA for apps and cloud
Many devices only work with an app and a cloud. The CRA covers these parts if the product cannot perform a function without them.
| Part | Covered by the CRA? | Note |
|---|---|---|
| Device with data connection | yes | product with digital elements |
| Cloud service without which a function is missing | yes, as part of the product | remote data processing |
| App supplied commercially | yes, as a product of its own | obligations as for software |
| Pure software-as-a-service without a device | generally not | other rules, e.g. NIS2 |
Data processing at a distance whose software the manufacturer develops or is responsible for, and without which the product could not perform one of its functions, is part of the product. The cloud connection of a camera or thermostat is therefore subject to the same requirements as the device.
An app supplied commercially is itself a product with digital elements. Whoever offers app and device plans both together: authentication, secured interfaces, updates and an aligned support period.
The risk assessment covers device, app and cloud service; the SBOM covers the components of all parts; the user information explains which functions depend on app and cloud and how long they are supported.
Register, classification, SBOM, reports with deadlines and a target page for users – one trial file free until 20.01.2027.
Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.