Defined term
Product with digital elements
The gateway definition: hardware or software plus the remote processing it depends on.
LAW Defined in Article 3 (Art. 3(1)). The verbatim definition is in the official text of Article 3; only the Official Journal is authentic.
sha256:27b7c6c64c773001… · CELEX 32024R2847The whole Regulation hangs on this term: a product with digital elements is a software or hardware product and its remote data processing solutions F-005.
The second half is the part people miss. Where a product depends on your own remote data processing — a backend or API without which it cannot perform one of its functions — that processing is part of the product F-107, because remote data processing means processing designed and developed by the manufacturer, or under its responsibility, and needed for one of the product's functions F-006.
What this means in practice
An app that is a shell around your API is one product, app plus API F-107. A cloud service that is not part of a product sits outside the Regulation and may fall under NIS2 instead F-008. The line is drawn by design dependence, not by deployment architecture.
Verified facts this page relies on
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1)
- F-006 Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Art. 3(2)
- F-107 Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII
- F-008 Cloud services that are not part of a product are outside the Regulation (they fall under NIS2); remote data processing essential to a product is within scope as part of that product. Art. 3(1)–(2), Recitals
Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).
Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.