# Does the Cyber Resilience Act apply to software as a service?

Generally not to a pure online service, but it can reach the cloud part of a product. The CRA covers products with digital elements placed on the market. Software provided only as a service over the internet, without a product the customer installs, is in principle outside it; the security of such services is mainly a matter for NIS2 where the provider is in scope. However, the CRA also covers remote data processing that a manufacturer designs as part of a product, where the product could not perform one of its functions without it: the cloud back-end of a smart camera or of a network sensor that ships with an agent are typical examples. So a company that sells both an installable component and a cloud service may have CRA duties for the combination. Map which parts of your offering are installed by customers and which run only on your side, and read the Regulation’s definitions with care. NetSenX, which ships agents together with a cloud service, applies the same question to itself.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/does-the-cra-apply-to-saas

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [What is an SBOM, and does the Cyber Resilience Act require one?](https://netsenx.com/en/faq/what-is-an-sbom-and-does-the-cra-require-one)
- [What is the EU AI Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-eu-ai-act-in-plain-terms)
- [Is AI in a security tool high-risk under the AI Act?](https://netsenx.com/en/faq/is-ai-in-security-tools-high-risk-under-the-ai-act)
- [What transparency duties does the AI Act set for chatbots and AI-generated content?](https://netsenx.com/en/faq/what-are-the-ai-act-transparency-duties)
- [What do data protection by design and by default mean under the GDPR?](https://netsenx.com/en/faq/what-is-data-protection-by-design-and-by-default)