CRA for Software Companies: What B2B and B2C Software Vendors Must Change

Many software companies assume the CRA is "an IoT thing." It's not. Standalone software placed on the EU market — whether downloaded, pre-installed, or distributed via app stores — is fully in scope.

What Changes for Software Vendors

• Secure development lifecycle (SDLC) — Documented processes for secure coding, code review, and testing
• Vulnerability handling — Defined process for receiving, triaging, and patching vulnerabilities
• Security updates — Free security patches for the support period, delivered without undue delay
• Technical documentation — Risk assessment, architecture description, and test results in the technical file
• Conformity assessment — Self-assessment for default category; third-party for Important/Critical

The SaaS Question

Pure SaaS is generally excluded from the CRA, unless the software includes a remote data processing component that is integral to the product's function. The boundary is nuanced — if your desktop app relies on cloud processing, the cloud component may be in scope.

Open Source Implications

Open-source software developed as a commercial activity falls under the CRA. The "open source steward" concept provides some protections for non-commercial open-source foundations, but companies monetizing open-source products are fully subject to the regulation.