# Does the Cyber Resilience Act apply to software companies?

Yes, if they place software on the EU market as a product. Installable applications, firmware, operating systems, libraries sold commercially and mobile apps are all products with digital elements, and the company that makes them available under its name is the manufacturer. Duties include a risk assessment, security by design and by default, handling and fixing vulnerabilities for the support period, documenting components, providing security information and instructions to users, and reporting actively exploited vulnerabilities and severe incidents under Article 14. Free and open-source software developed or supplied outside a commercial activity is largely outside the Act, and organisations that support open-source projects for commercial use, called open-source software stewards, have a lighter set of duties. Software you build only for your own internal use is not placed on the market. If you sell software, start by listing your products, their support periods and your vulnerability-handling process, and read the Regulation itself for the details. NetSenX does not assess whether your software complies.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/does-the-cra-apply-to-software-companies

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [Does the Cyber Resilience Act apply to software as a service?](https://netsenx.com/en/faq/does-the-cra-apply-to-saas)
- [What is an SBOM, and does the Cyber Resilience Act require one?](https://netsenx.com/en/faq/what-is-an-sbom-and-does-the-cra-require-one)
- [What is the EU AI Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-eu-ai-act-in-plain-terms)
- [Is AI in a security tool high-risk under the AI Act?](https://netsenx.com/en/faq/is-ai-in-security-tools-high-risk-under-the-ai-act)
- [What transparency duties does the AI Act set for chatbots and AI-generated content?](https://netsenx.com/en/faq/what-are-the-ai-act-transparency-duties)