Software and open source under the CRA

Software as a product

Whoever supplies software commercially – as a program, app or firmware – is a manufacturer under the CRA, with the same obligations as for hardware.

Cloud and remote processing

Pure software-as-a-service is generally not covered by the CRA but by other rules such as the NIS2 Directive. If remote data processing is part of the product and needed for its function, however, it is covered too.

Open source

Free and open-source software supplied outside the course of a commercial activity does not fall under the manufacturer obligations. Whoever integrates open-source components into their own products remains responsible for the whole product. A lighter regime applies to open-source software stewards that sustainably support commercial use.