Question 1

Does the CRA apply to free mobile apps?

Accepted Answer

Often, yes. The CRA covers supply in a commercial activity "whether in return for payment or free of charge" (CRA Art. 3(22)). Monetising services through the app, or requiring personal data for reasons other than security, compatibility or interoperability, are signs of commercial activity (CRA Recital 15; Guidance ¶54).

Question 2

Is my app's backend covered by the CRA?

Accepted Answer

Yes, if the app cannot perform one of its functions without it and you designed it or had it built (CRA Art. 3(2)). Login, sync, onboarding, configuration and update delivery are examples; telemetry kept only for statistics is not (Guidance ¶190, ¶192).

Question 3

Do mobile apps need a CE marking?

Accepted Answer

In-scope apps placed on the market from 11 December 2027 do, after a conformity assessment (CRA Art. 13(12), 71(2)). For software it goes on the declaration of conformity or on the website accompanying the app (CRA Art. 30(1)).

Question 4

Must an app already in the App Store or Google Play report vulnerabilities?

Accepted Answer

Yes. Article 14 reporting has applied since 11 September 2026, including to products placed on the market before 11 December 2027 (CRA Art. 69(3), 71(2)).

Question 5

Do I have to publish my app's SBOM?

Accepted Answer

No. "Manufacturers should not be obliged to make the SBOM public" (CRA Recital 77). It goes in the technical documentation (CRA Annex VII).

Question 6

Is my companion app for a smart device a separate product?

Accepted Answer

No, in the Commission's reading. Software a device needs to be operated, configured or used is part of the device's product, even when it comes from an app store (Guidance ¶25, Example 9).

Question 7

Are TestFlight or open beta builds covered?

Accepted Answer

Unfinished software may be made available only for the limited time needed for testing, with a visible sign that it does not comply with the CRA and will not be available for other purposes (CRA Art. 4(3)).

Question 8

A third-party SDK in my app is being exploited. Do I report it?

Accepted Answer

If the vulnerability is actively exploited in your app, yes: you report it as the app's manufacturer. If it is not reachable or not exploited in your app, reporting is not mandatory for you, but you still handle it and tell the SDK's maintainer (Guidance ¶218; CRA Art. 13(6)).