What is a product with digital elements? Are stand-alone software or firmware products with digital elements?

A product with digital elements is defined as “a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately” (Article 3(1)).

Remote data processing is defined as “data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions” (Article 3(2)).

Software is defined as “the part of an electronic information system which consists of computer code” (Article 3(4)).

Hardware is defined as “a physical electronic information system, or parts thereof capable of processing, storing or transmitting digital data” (Article 3(5)).

Electronic information system is defined as “a system, including electrical or electronic equipment, capable of processing, storing or transmitting digital data” (Article 3(7)).

A product with digital elements can take many forms, for example:

A product with digital elements also includes its remote data processing solutions.

As stated in Recital 12, websites that do not support the functionality of a product with digital elements are not themselves products with digital elements. Websites that support the functionality of a product with digital elements may fall in scope of the CRA to the extent that they meet the definition of remote data processing (Article 3(2)).

Similarly, services, such as standalone Software-as-a-Service (SaaS) or other cloud solutions designed and developed outside the responsibility of a manufacturer of a product with digital elements are not themselves products with digital elements. Where, on the other hand, such services meet the definition of remote data processing, they fall within the scope of the CRA.

The concept of remote data processing will be part of separate guidance.

© 2025 European Union • CC-BY 4.0“FAQs on the Cyber Resilience Act” p.7–8 (PDF)
Disclaimer

Disclaimer: This document is prepared by the Commission services and should not be considered as representative of the European Commission’s official position. The replies to the FAQs do not extend in any way the rights and obligations deriving from applicable legislation nor introduce any additional requirement. The expressed views are not authoritative and cannot prejudge any future actions the European Commission may take, including potential positions before the Court of Justice of the European Union, which is competent to authoritatively interpret Union law.