Which three terms matter?
Art. 2(1) covers products with digital elements made available on the market whose intended purpose includes a direct or indirect data connection. Art. 3(1) defines the product as a software or hardware product and its remote data processing solutions. Art. 3(2) defines remote data processing as processing at a distance for which the software is designed under the manufacturer's responsibility and without which the product could not perform one of its functions.
The pivot is the nesting: remote data processing is not a product of its own but a component of the product it belongs to. Recital 12 draws the line: websites that do not support the functionality of a product and cloud services designed outside the responsibility of a manufacturer are out of scope; SaaS, PaaS and IaaS fall under the NIS 2 Directive.
How does the Commission's three-step test work?
The Commission guidance of 27 July 2026 (C(2026) 5252, legally non-binding, so far in English only) turns this into a three-step test: remote execution, functional necessity, manufacturer responsibility. The delimiting sentence reads: “software that executes remotely and is merely accessed by the user is not, on that basis alone, a product with digital elements”.
| Solution | Classification | Reasoning |
|---|---|---|
| Native app (iOS/Android) from the store | Covered | Software executed on the end device and made available on the Union market via the store. Also covered: the server estate insofar as the app could not perform a function without it and it was developed under the manufacturer's responsibility. |
| Browser extension, locally installed client | Covered | Executed on the end device. |
| Pure online banking portal in the browser | Not covered as a product – with a caveat | As a stand-alone browser portal not a product with digital elements. But the same server-side platform can be the remote data processing solution of the app; to that extent Annex I applies to it after all. |
| Stand-alone cloud service (SaaS) | Not covered | Falls under the NIS 2 Directive; cloud components are captured only through the remote-data-processing construction. |
| Application code of a single-page app in the browser | Open | The guidance makes no discernible statement. The case lies between “executed locally” and “executed remotely and merely accessed”; both classifications are defensible. Document as a contested point. |
That the same function is covered as an app and not in the browser is a side effect of a definition designed for connected hardware. The guidance adopts the distinction by place of execution but does not answer the double-regulation question. Whoever documents scope in a German-language audit file currently relies on an English text and bears the translation risk.
Who is the manufacturer: does the brand or the contract decide?
The brand. Art. 3(13) CRA: a manufacturer is a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured and markets them under its name or trademark – for payment, monetisation or free of charge. Making available is any supply in the course of a commercial activity (Art. 3(22)). The bank that has its app built by a software house and publishes it under its logo in the store is the manufacturer; the software house is its supplier.
| Provision | Role | Content |
|---|---|---|
| Art. 3(13), Art. 13 | Manufacturer | Develops, manufactures or has developed and markets under its own name or trademark. Bears the obligations of Art. 13 and 14. |
| Art. 18 | Authorised representative | The manufacturer may appoint an authorised representative in writing. The provision is not limited to manufacturers outside the Union. |
| Art. 19, 20 | Importer, distributor | Obligations before placing on the market and when making available, including checking CE marking and passing on vulnerability information. |
| Art. 21 | Importer or distributor as manufacturer | Whoever markets a product under its own name or trademark or substantially modifies it is subject to the manufacturer obligations. |
| Art. 22 | Third party as manufacturer | Whoever carries out a substantial modification and makes the product available is considered its manufacturer. |
| Art. 24, 25 | Open-source software steward | Light-touch regime; the dividing line runs between commercial activity and its absence, not between open source and proprietary. |
In many institutions the manufacturer is written into the contract with the service provider: it develops, it is liable, it patches. For the allocation of roles under the CRA that is irrelevant. The duty to issue an early warning within 24 hours lies with the bank – even if the knowledge of the vulnerability sits with the developer. What belongs in the contract is therefore not “the contractor is CRA-compliant” but: who detects active exploitation, who informs whom by when, who writes the early warning, who delivers the final report.
Which exemptions does Art. 2 contain, and what is not among them?
Art. 2(2) to (4), (6) and (7) exempt exhaustively: medical devices and in-vitro diagnostics, motor vehicles, certified aviation products, marine equipment, spare parts replacing an identical component, and products developed exclusively for national security or defence or designed to process classified information. For spare parts the guidance requires an explicit repair intent.
The CRA contains no sectoral exemption for the financial sector, none for essential or important entities under NIS 2 and none for providers under sectoral supervision. This is not an omission but the consequence of the design: the act is product law. Art. 2(5) allows the Commission to narrow the scope by delegated act – exercised once so far, for two- and three-wheel vehicles (Delegated Regulation (EU) 2025/1535). DORA cannot serve as a reference framework because DORA sets no product requirements.
When is a bank or insurer the manufacturer of an app?
A bank with a development partner manufactures its app; an insurer becomes manufacturer through a white-label app under its own brand.
The app runs under the bank's brand, a service provider develops the client, core functions sit in the backend of the sector data centre. Result: the bank is the manufacturer of the app; the backend is covered insofar as the app could not perform a function without it. The online portal on the same platform is not a product as a portal – but the shared platform is remote data processing of the app.
An insurer takes over a provider's app base, has it adapted and publishes it under its own name. Result: marketing under its own brand establishes the manufacturer role (Art. 3(13), Art. 21). The provider of the base is a supplier; its commitments on components, vulnerabilities and support belong in the contract but do not replace the insurer's own role.
How do you assess product and role?
In five steps: product boundary, making available, responsibility, role per entity and documentation of open points.
- Delimit the product: what executes on the end device, what runs server-side, which server modules does the app need for one of its functions?
- Document making available: to whom, through which legal entity, via which channel, since when (legacy product?).
- Document responsibility: who commissions, develops, publishes, modifies, maintains? Flag contradictions between contract and actual practice.
- Record the role per legal entity – within a group one entity can be manufacturer and another distributor.
- Document open flanks (single-page app, remote data processing of the platform) as contested points with reasoning.
Frequently asked questions
Is calling it “SaaS” or “web app” enough to fall outside the CRA?
No. What matters is whether software executes on the end device and whether server-side components are necessary for a function of a covered product. A pure browser portal is not covered as a product but can be remote data processing of the app.
Is the bank the manufacturer if a service provider developed the app?
Yes, if the bank markets the app under its own name or trademark. Art. 3(13) CRA expressly covers whoever has a product developed. The service provider is a supplier.
Is there an exemption for supervised financial entities?
No. Art. 2 CRA lists the exemptions exhaustively; the financial sector is not among them. DORA is organisational law and cannot displace the product act.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).