Topic

Scope framework

How Article 2 decides what the Regulation touches at all.

Scope is a three-step test. First, is there a product with digital elements — software or hardware with a direct or indirect data connection, including its remote data processing solutions F-005? Second, is it made available in the course of a commercial activity — price, paid support, or other monetisation all count F-007? Third, does a carve-out take it back out: medical devices, in vitro diagnostics, type-approved motor-vehicle products, certified civil aviation products, marine equipment, identical spare parts and national-security or defence products are among the carve-outs F-010.

The recurring edge cases

Pure cloud services that are not part of a product fall outside the Regulation and into NIS2 territory, while remote data processing essential to a product travels with the product F-008. Non-monetised free and open-source software is not considered placed on the market at all F-009.

Why this topic exists

Almost every hard question we see is a scope question wearing a costume — "does my backend count", "does my SDK count", "does my free tier count". The answer machinery starts here and ends in a product-specific check.

Verified facts this page relies on

F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals
F-008 Cloud services that are not part of a product are outside the Regulation (they fall under NIS2); remote data processing essential to a product is within scope as part of that product. Art. 3(1)–(2), Recitals
F-010 Excluded: medical devices (Regulation (EU) 2017/745) and in vitro diagnostics (2017/746) and motor-vehicle type-approved products (2019/2144) (Art. 2(2)); civil aviation products certified under Regulation (EU) 2018/1139 (Art. 2(3)); marine equipment under Directive 2014/90/EU (Art. 2(4)); spare parts made to identical specifications (Art. 2(6)); products developed or modified exclusively for national security or defence, or designed exclusively to process classified information (Art. 2(7)). Art. 2(2)–(4), (6)–(7)
F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1)
F-009 Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Not sure whether this applies to your product? Check if the CRA applies to you on CRARequired.