Is my desktop or on-prem software in scope? The CRA SaaS exclusion

The line: products placed on the market vs. services

The CRA regulates products with digital elements placed on the EU market. Under Article 3, a product with digital elements is software or hardware (and its remote data-processing solutions) whose intended use includes a data connection. Under Article 2, the regulation applies to those products — not to services in general.

In practice:

• In scope: software a customer installs and runs — on-prem/self-hosted applications, desktop applications, and embedded software. If you ship a build that leaves your hands and runs on someone else's machine, you are placing a product on the market, and Article 14 reporting applies.
• Generally out of scope: pure software-as-a-service. A hosted service the customer never installs is regulated as a service under other regimes, not as a CRA product.

Where it gets ambiguous

The SaaS exclusion is not a blanket "cloud is exempt" rule. A remote data-processing solution that is integral to an in-scope product can be pulled in with that product. And a company shipping both an installed client and a hosted backend has to reason about each separately. If your model is genuinely mixed, that is a "confirm with counsel against Article 2" situation, not a self-serve yes/no.

Retroactivity catches long-lived products

The reporting duties are not limited to new releases. A product placed on the market before the regulation's later general application date is in scope for reporting if it is still supported. A desktop app you first shipped years ago and continue to patch is exactly the kind of product this reaches.

If you are unsure which side of the line you are on, the free readiness report gives you a scope verdict against the relevant article — in scope, likely out of scope, or needs legal advice — before you commit to anything.