Topic
Remote data processing
The clause that pulls backends into a product Regulation.
Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer or under its responsibility, and without which the product could not perform one of its functions F-006. The definition is the hinge: a product with digital elements includes its remote data processing solutions F-005.
The two-sided boundary
Where a product depends on your own backend or API — one without which it cannot perform a function — that remote processing sits with the product F-107. Cloud services that are not part of a product go the other way, out of this Regulation and toward NIS2 F-008.
How to reason about it
Ask what breaks when the backend is unplugged. A companion app that loses its sync has lost one of its functions, just as a lock that stops opening has; the test is not whether the product still mostly works F-006. Function-by-function is the granularity the definition actually uses F-006.
Verified facts this page relies on
- F-006 Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Art. 3(2)
- F-107 Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII
- F-008 Cloud services that are not part of a product are outside the Regulation (they fall under NIS2); remote data processing essential to a product is within scope as part of that product. Art. 3(1)–(2), Recitals
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1)
Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).
Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.