Does the CRA cover your SaaS or connected product? Start with the boundary
Assess the product and the role of its remote functions, not just the label “SaaS”. A connected device may depend on cloud processing that belongs in the product boundary; generic standalone SaaS is not automatically covered.
Draw the system before classifying it
List the components the customer needs to use the product: device, firmware, mobile app, desktop software and remote functions. For each remote service, record which product function stops working if that service disappears.
The CRA’s product concept includes certain necessary remote data processing developed by or under the manufacturer’s responsibility. Product scope, exclusions and conformity routes require case-by-case analysis. Avoid treating “uses the cloud” as a complete legal answer.
Questions to take into a scope review
- What is made available to customers, and under whose name or trademark?
- Which versions, optional modules and components are supplied separately?
- Which functions require a network connection or remote processing?
- Who develops or controls each remote function?
- Where is the product made available, and which economic-operator roles apply?
- Which sector-specific exclusions or transitional provisions might be relevant?
Illustrative boundaries
| Scenario | Engineering question to investigate |
|---|---|
| Device with a companion cloud | Which device function requires the remote processing, and who is responsible for it? |
| Downloadable desktop product | What software is supplied, how does it connect, and what updates are supported? |
| Standalone business SaaS | Is a covered product or necessary remote product function involved? Do not assume coverage from the SaaS label alone. |
| Separately sold software component | What is placed on the market and how is its intended use documented? |
Record the decision and its assumptions
Create a short scoping record with the product diagram, market assumptions, version boundaries, exclusions considered and people who reviewed the conclusion. Mark unresolved legal questions explicitly.
Revisit the record when packaging or functionality changes. Turning an optional companion service into a required product function can change the technical facts that supported the previous analysis.
What to prepare for an assessment
Bring a product description, architecture sketch, release list, dependency information and the customer-facing support commitments. Identify the people who can explain supplier responsibilities and distribution arrangements.
Dotgrey Continent performs an initial technical applicability review as part of the assessment and prepares the engineering work. Formal interpretation and conformity decisions should be confirmed with qualified regulatory counsel.
Official sources and references
The suggested workflows are Dotgrey engineering recommendations. Official texts determine obligations; applicability must be checked for each product.