SaaS, cloud and remote data processing: when an online service is part of the product

An online service is part of the product when three conditions are met at the same time (Article 3, point (2)). The data processing takes place at a distance. Without it, the product could not perform one of its functions. And the software for it was developed by the manufacturer itself or under its responsibility. The service is then "remote data processing" and part of the product with digital elements (Article 3, point (1)). It must meet the requirements of Annex I and is covered by the reporting obligation under Article 14. A website that does not support a product function, and a cloud service outside the manufacturer's responsibility, are not part of it. Pure software as a service with no installation at the user's end is not a product within the meaning of the CRA (Commission guidance, paragraph 21); under recital 12, the NIS2 Directive applies to it where the provider reaches its thresholds.

What does the Regulation say?

Article 3, point (1) defines a product with digital elements as a software or hardware product including its remote data processing solutions. Article 3, point (2) defines remote data processing as data processing at a distance. The software for it must be designed and developed by the manufacturer or under its responsibility, and its absence would prevent the product from performing one of its functions. All three elements must be present. If one is missing, the service is not part of the product.

Recital 11 narrows this down: remote processing is covered only in so far as it is necessary for the product to perform its functions. The example given there: where a mobile application requires access to an API or a database provided by means of a service developed by the manufacturer, that service is covered. Measures for the security of the manufacturer's network and information systems as a whole are not covered. Recital 12 adds the cloud perspective: cloud solutions are remote data processing only if they meet the definition. A cloud function for controlling a smart home device remotely, for example, is covered. Websites that do not support the functionality of the product, and cloud services outside the manufacturer's responsibility, are not. Software, platform and infrastructure services (SaaS, PaaS, IaaS) fall under NIS2 where its thresholds are reached.

How does the Commission guidance apply the three criteria?

The Commission guidance C(2026) 5252 of 27 July 2026 deals with remote data processing in section 8 of its Annex (paragraphs 181 to 208 and the use cases in 8.3). The information on this page is taken from that text.

• Criterion 1, at a distance: public cloud, private cloud or the manufacturer's own servers all count as at a distance (paragraphs 186 and 187). A cellular network and a router are only a communication channel, not processing (section 8.3.5). The guidance regards this element as relevant but not sufficient; the decisive questions are the next two, and both must be answered yes (paragraphs 185 and 188).
• Criterion 2, function: at least one product function fails without the service; this means any function, not just the core function (paragraph 189). Examples: sending commands to a device, synchronising files, onboarding the user, configuration, automated distribution of updates to the product, identity and access management (paragraph 190). Downstream systems with which the product does not interact directly, such as HR management, customer management, the build environment or the internal distribution of updates to edge locations, are not covered (paragraphs 182 and 205).
• Criterion 3, responsibility: the software comes from the manufacturer or was developed under its responsibility, meaning by a service provider on the basis of its designs and specifications (paragraph 195). Who operates the infrastructure is not decisive: manufacturer software on rented infrastructure is remote data processing (paragraphs 196 and 198). Bought-in third-party SaaS integrated into the product is not remote data processing but is to be treated like a component, with a due diligence obligation similar to Article 13(5) (paragraphs 200 and 201).

Three examples from the guidance (section 8.3): a smart thermostat whose cloud software the manufacturer developed and runs on rented infrastructure has remote data processing that is part of the product. An industrial robot whose manufacturer runs a picking service in the cloud, without which the robot cannot pick: also covered. A mobile banking app that integrates a bought-in chat solution from a third-party provider: the chat is not covered, the app itself remains a product.

Which examples are part of the product, and which are not?

The rows on remote maintenance are derived from the wording of the Regulation; they are not classifications by the Commission. The guidance does not mention remote maintenance, but it contains two comparable cases: a service developed by the manufacturer that sends commands to an industrial robot is remote data processing (section 8.3.4); a bought-in support service from a third-party provider is not and is treated like a component (section 8.3.1). For the common mixed case, where service technicians access devices through a portal built in-house without any product function depending on it, there is no example; under paragraphs 192 and 193, this would not be remote data processing, but it belongs in the risk assessment. On licence servers, the guidance only mentions the comparable case of an authentication portal. If one of these cases applies to you, document your classification and, where necessary, have it reviewed by a lawyer.

What applies to locally installed software with a cloud backend?

This is the most common case among mid-sized software manufacturers: a client is installed at the customer's site, and some of its functions run through a backend operated by the manufacturer. The client is a product. The backend is remote data processing and therefore part of the same product, in so far as the client loses a function without the backend and the manufacturer developed the backend software itself or had it developed. Parts of the backend that the client does not need are not covered, nor are third-party services that the backend itself uses.

The line therefore runs not between "local" and "cloud", but between "product function" and "everything else". For every backend module, the three questions should be answered and the answers recorded in the technical documentation. A company that runs software exclusively in the browser, by contrast, is not a manufacturer under the CRA; NIS2 may apply to it, see CRA and NIS2 compared.

What are the consequences of the classification?

1. Annex I applies to the backendThe essential requirements of Annex I, Part I (product properties) and Part II (vulnerability handling) apply to the product including its remote data processing. The risk assessment under Article 13(2) and (3) must include the backend.
2. The documentation covers the backendTechnical documentation, SBOM and conformity assessment relate to the product as a whole. A declaration of conformity for the client alone falls short.
3. The reporting obligation covers the backendAn actively exploited vulnerability in the backend, or a severe incident there, is a case under Article 14, with an early warning notification within 24 hours of becoming aware. Monitoring of the backend therefore belongs in the same readiness set-up as the reporting address for the product.
4. Third-party SaaS needs due diligence, not conformityFor bought-in services, a due diligence obligation similar to Article 13(5) applies (guidance, paragraph 201): assess them, describe them in the technical documentation (paragraph 204), and inform the provider of any vulnerabilities (Article 13(6)). There is no CE marking for the service.
5. Changes to the backend can be a substantial modificationAccording to the guidance, new externally accessible interfaces, or replacing local encryption with a remote service, count as a substantial modification (paragraphs 109 and 110, examples 49 and 50). Details under Substantial modification.

Common mistakes

• "Our backend is just SaaS, so it is outside the scope." If the backend supports product functions and comes from the manufacturer, it is part of the product.
• The reverse: treating a third-party cloud as your own remote data processing. A bought-in service is a component subject to due diligence, not part of your own conformity assessment.
• Treating the manufacturer's entire IT as the product. Recital 11 excludes the general security of the manufacturer's systems; what is covered are the modules the product works with directly.
• Leaving backend incidents out of the reporting organisation. If you only monitor the reporting address for the client, you will miss the deadline when the backend is attacked.
• Not documenting the classification. For every backend module, it should be recorded whether, and why, it is part of the product.

Whether a product falls under the CRA at all, and how its cloud elements are to be classified, can be established in advance with the Applicability Check. For manufacturers whose product includes remote data processing, CRA Response Center monitors the reporting addresses for client and backend in one place, classifies incoming messages and alerts the people responsible. The manufacturer submits the notification to the ENISA platform itself.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Further reading

• CRA and NIS2 comparedProduct or entity: two reporting obligations.
• Substantial modificationWhen a backend update creates a new product.
• The CRA for agencies and custom softwareWho the manufacturer is when a service provider builds the backend.
• Severe incidentWhen an incident in the backend has to be reported.

Sources

• Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 3, points (1) and (2), Article 13(2), (3), (5) and (6), Article 14, recitals 11 and 12, Publications Office of the European Union, accessed 7 October 2026.
• Commission guidance C(2026) 5252, Annex, paragraphs 17 to 21, 109, 110 and section 8 (paragraphs 181 to 208, use cases 8.3.1 to 8.3.5), European Commission, 27 July 2026.
• Remote data processing solution (RDPS), eucybersecurity.org, glossary with examples from the guidance C(2026) 5252, 2026.
• Cyber Resilience Act guidance: products and obligations, Gamingtechlaw, 5 August 2026.
• CRA: the fine line between SaaS and digital products, DLA Piper, 16 February 2026.
• FAQ: The Cyber Resilience Act, cyberresilienceact.eu, 2026.