Remote data processing
The app for the machine, the licence server, the back end for remote maintenance: what runs on the manufacturer's server can legally be part of the product. Three criteria decide.
Remote data processing is data processing that takes place outside the product, whose software the manufacturer has developed itself or under its responsibility, and without which the product could not perform one of its functions. It is part of the product with digital elements.
Definition in the Regulation
Article 3, point (2) defines remote data processing as "data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions". Article 3, point (1) expressly includes these solutions in the definition of the product. Recital 11 limits this to processing that is necessary for the product's functions, such as an API or database that an app reaches through a service provided by the manufacturer. Recital 12 gives the cloud function for remotely controlling a smart home device as an example that is covered, and websites that do not support the product's functions and cloud services outside the manufacturer's responsibility as examples that are not. For pure SaaS, PaaS and IaaS offerings, recital 12 refers to the NIS2 Directive.
What it means for manufacturers
According to the Commission guidance C(2026) 5252 (paragraph 188), two questions together decide whether processing at a distance counts: would at least one product function fail without it, and was the software developed by the manufacturer or under its responsibility? Who operates the servers is irrelevant (paragraph 196); manufacturer software running on third-party cloud infrastructure is remote data processing. An integrated service from a third party, by contrast, is not remote data processing but is treated like a component (paragraphs 200 and 201), subject to the due diligence obligation under Article 13(5). Only the modules the product works with directly are covered, not downstream systems such as a CRM or build servers. Example: the back end without which the remote monitoring of a machine does not work is part of the product, and therefore subject to Annex I, the risk assessment and the reporting obligation. A customer portal for documentation and orders is not.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Product with digital elements
- NIS2 (Directive (EU) 2022/2555)
- Due diligence for third-party components
- Commission guidance