The situation
A sensor supplier hosts a service that interprets readings and supplies the device’s advertised alerts. The team also sells an unrelated browser dashboard. Assess the two offerings separately: the fact that both use cloud hosting does not establish the same product boundary.
Facts that change the answer
- Which advertised device function fails without the remote service?
- Who designed or commissioned the remote processing?
- Is the assessed offering supplied commercially on the Union market?
Compare the worked results
These examples use the published assessment with the assumptions shown below. Change the facts in your own assessment before relying on its result.
Remote processing needed by the device
Hypothetical example 1
Key facts in this example
- How the assessed offering reaches the user
- remote data processing needed by a product
All recorded assumptions (8)
- Product, software or service being assessed
- Hypothetical example product
- How the assessed offering reaches the user
- remote data processing needed by a product
- The intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network
- yes
- The offering is supplied for distribution or use on the Union market
- yes
- The supply occurs in the course of a commercial activity
- yes
- Sector-specific or public-purpose position
- no exclusion identified
- Free and open-source software position
- not free and open source software
- Assessed role in the supply chain
- manufacturer under own name or trademark
Standalone browser application
Hypothetical example 2
A browser-only application, website, or independent remote service is not a CRA product merely because it is online. Reassess if it is necessary remote processing for a covered product.(CRA recitals 11–12; Commission 2026 guidance section 2.2)
Key facts in this example
- How the assessed offering reaches the user
- browser only web application or website
All recorded assumptions (8)
- Product, software or service being assessed
- Hypothetical example product
- How the assessed offering reaches the user
- browser only web application or website
- The intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network
- yes
- The offering is supplied for distribution or use on the Union market
- yes
- The supply occurs in the course of a commercial activity
- yes
- Sector-specific or public-purpose position
- no exclusion identified
- Free and open-source software position
- not free and open source software
- Assessed role in the supply chain
- manufacturer under own name or trademark
Evaluated on 2026-09-13 using EU Cyber Resilience Act scope and economic-operator determination, version 2026.09.02. A completed example is not a customer Record or a declaration of conformity.
Evidence to keep
- Architecture diagram showing the device-to-service dependency
- Intended-purpose statement and customer-facing feature description
- Identity of the party responsible for the combined offering
Keep source artifacts in their controlled systems and record their references, responsible owner and review date with the decision.
Your next step
Record the boundary before selecting a product class. Include the required remote processing in the product assessment and keep unrelated services separate.
Choose your real product or vulnerability case in the workspace. The selected assessment will be highlighted; example answers are not copied into your record.
Sources and application dates
- Regulation (EU) 2024/2847 (Cyber Resilience Act)Articles 2, 3, 18 and 21–24; recitals 11–19
- European Commission CRA implementation guidance (2026)Sections 2, 3 and 8 — scope, free and open-source software, and remote data processing
Manufacturer reporting applies from 11 September 2026. Broader product requirements apply from 11 December 2027; these product-readiness examples support preparation. Open-source-steward obligations have their own application date.
These examples structure a decision and do not replace the Regulation, official guidance or product-specific professional advice. Not lawyer-reviewed.