Question 1

Does the Cyber Resilience Act apply to SaaS?

Accepted Answer

Not to a SaaS used only through a browser, on that basis alone (Guidance ¶21). It applies when the SaaS is the remote data processing of an installed product you supply, such as an app, client, extension, agent or device (CRA Art. 3(1)–(2)).

Question 2

Is a progressive web app (PWA) covered by the CRA?

Accepted Answer

A web application, including a PWA, accessed exclusively through a web browser is not a product with digital elements by itself. It is covered only to the extent it supports the functions of a product (Guidance ¶21, Example 5).

Question 3

Our SaaS has a mobile app. Is the backend in scope?

Accepted Answer

Yes, if the app cannot perform one of its functions without the backend and you designed it or had it built (CRA Art. 3(2)). The CRA gives this case as its own example: an app that needs an API or database provided by a service developed by the manufacturer (CRA Recital 11).

Question 4

Does analytics or telemetry count as remote data processing?

Accepted Answer

No, not when it is collected only for statistics or future product development (Guidance ¶192). You should still consider its risks in your risk assessment (Guidance ¶193).

Question 5

We run on AWS, Azure or Google Cloud. Is the cloud provider responsible?

Accepted Answer

Not for your code. Your own software on rented IaaS or PaaS is designed by you, so it can be your remote data processing (Guidance ¶198–199). The provider's underlying layers are treated like third-party components, which you assess and check (Guidance ¶201).

Question 6

Does a SaaS have to report to ENISA under the CRA?

Accepted Answer

A standalone web SaaS has no CRA reporting duty as a product (Guidance ¶21). If it is part of a product, actively exploited vulnerabilities and severe incidents affecting it must be reported since 11 September 2026 (CRA Art. 14, 71(2); Guidance ¶178). Other laws, such as NIS2, may have their own reporting rules.

Question 7

Is our marketing website or help centre in scope?

Accepted Answer

Not if it only presents information, even when the product links to it. A web page becomes remote data processing only if it enables a function of the product, such as a login portal that issues tokens (Guidance ¶194, Example 6).

Question 8

We give paying customers a CLI or SDK. Does that change anything?

Accepted Answer

Yes, in our reading. Downloadable software supplied to customers is a product with digital elements, even when it comes "free" with the subscription, and the service it needs can be its remote data processing (CRA Art. 3(1)–(2); Guidance ¶20, ¶24, ¶54).