Software

Software sold in the EU is a PDE.

You do not need to ship a device to fall under CRA. An application, a library or an embedded system sold separately is a product with digital elements if you place it on the market under your name.

Book a call

Regulation (EU) 2024/2847 does not ask whether you ship a box. It asks whether you place a product with digital elements on the Union market under your name or trademark. An application, a library, an SDK, embedded software sold separately - that is a PDE. The dates are the same as for hardware: Article 14 from 11 September 2026, essential requirements and CE from 11 December 2027.

A repository scanner does not replace a version catalogue, an Annex I risk assessment or an EU declaration. CRA applies to the product you place on the market, not “the company backlog” once. A substantial modification is a new placing: a new major version, a new digital function that changes the risk, a rebrand that makes you the manufacturer of record.

The file has to be assembled without moving source code off the network. Crado AI is on-premise for that reason: the SBOM, the CVE queue and the CE path stay with you.

What counts as a product with digital elements in software

An application sold under your mark

Desktop, mobile, an engineering tool, an on-prem client. If the name on the listing is yours, start from the assumption that it is a PDE.

A library, SDK or runtime

A component sold separately is its own product. Due diligence on dependencies stays with you even if the code is open source.

Embedded software sold on its own

Firmware or a stack you license without a board does not leave scope just because “it is not a device”.

An internal tool is not an automatic exemption

Scope is decided at placing on the market. If the same software goes to a customer under your mark, the catalogue needs a row.

Usual friction

An SBOM from CI, not from a spreadsheet after launch.
A support period sales never promised and the regulation now requires.
Notifying an actively exploited vulnerability in 24 hours.

What Crado AI holds

Product versions tied to SBOM and CVE.
Annex I on software properties: updates, default configuration, no known exploits at placing on the market.
Documentation and the CE path without moving source code off your network.

What usually hurts a software house

The store version and the SBOM version drift after two sprints.
A support period promised “as long as they subscribe” has no month and year on the package.
A CVE in a production dependency lands on Friday, and Article 14 does not wait until Monday.

How CRA lands on software

A version catalogue with the date you made it available and a support end with month and year, not “as long as the subscription runs”.
An SBOM from the pipeline, locked to the store version, not a monorepo dump from main.
Annex I Part I: secure defaults, updates with a clear opt-out, no known exploitable vulnerabilities at placing on the market.
Annex I Part II and Article 14: a queue, an owner, a 24h / 72h clock to the CSIRT of the main establishment and ENISA.
The technical file and the EU declaration before the version leaves the distribution channel.

What to have running before Article 14

01

Versions as PDEs

Every release on the Union market has a row: name, version, markets, date, support end.
02

SBOM from CI

A build that does not match the SBOM does not ship. Third-party lines carry supplier and version.
03

Risk on Annex I

A gap does not live next door in Jira. It points at the requirement it fails.
04

The 24h queue

A named owner, a path to the single reporting platform, a drill on a production dependency.

Questions from a software house

Does SaaS fall under CRA?

CRA applies to a product with digital elements placed on the market. A pure cloud service is a different conversation. An on-prem client, an installer, a library or an app under your mark - start from a PDE and document why not, if you think it is not.

Does open source get us out?

Not from due diligence if you place a product under your name and third-party components sit inside it. The SBOM and the assessment stay on the product you ship.

Is every patch a new placing on the market?

No. A substantial modification is. A new major version or a function that changes the cybersecurity risk gets a new row, a new SBOM and a new Annex I decision.

Why on-premise for software?

The SBOM and the technical file describe the composition of your code. They do not need to land on the CRA vendor’s server.

Software sold in the EU is a PDE - the longer piece ->