Two words carry more of the Cyber Resilience Act, Regulation (EU) 2024/2847, than any other: "placed on the market". The essential requirements apply at that moment (Article 13(1)). The transition rule of Article 69(2) says products placed on the market before 11 December 2027 are subject to the Regulation "only if, from that date, they are subject to substantial modifications". The tier, the support period, the technical file, all attach to a product, and Article 3(21) says a product is placed on the market "the first time it is made available". For a router that is a shipment. For software that ships as a download, an app-store listing or a client the customer installs, it was not obvious what the moment was, or whether the thing shipped was a product at all. The Commission's guidance on the application of the Regulation, C(2026) 5252 of 27 July 2026, sections 2.1 and 2.2, paragraphs 10 to 21 with examples 1 to 6, answers both. This article is those paragraphs, with the transition entries of the Commission's FAQ, version 1.4 of 4 September 2026.
Which software is a product with digital elements
Paragraph 20 gives the test: "a software product with digital elements must be provided to a user, obtained by that user and operated on, or as part of, an electronic information system on the user's side". Software "that is downloaded, installed or otherwise supplied to the user and that executes on the user's electronic information system meets these criteria, including for example where it takes the form of a browser extension or an application developed using web technologies but supplied for local execution".
Paragraph 21 gives the other side: "software that executes remotely and is merely accessed by the user is not, on that basis alone, a product with digital elements". That "is typically the case for web applications, including progressive web apps, where they are accessed exclusively through a web browser", and for websites, which "are not themselves to be considered as products with digital elements" and enter the Regulation only "to the extent that they qualify as remote data processing" for a product that is one.
The four examples draw the map for a software company. A mobile app downloaded from a store and installed is a product (example 3). A desktop application "built using web technologies but packaged for local installation" is a product (example 4). "A web application accessed by the user exclusively through a web browser is not a product with digital elements", but "an application supplied to the user as a locally installed client that executes on the user's device is", and if that client depends on processing at a distance to perform a function, that processing is part of the product too (example 5). A website that presents information is not a product (example 6). Whether a product is then in scope is Article 2 and the commercial-activity test; the scope article and the free determination take it from there.
So a company that offers the same functionality as a browser-based SaaS and as a desktop client has one thing outside the Regulation and one inside it, and the Regulation's date question applies to the second.
When standalone software is placed on the market
Paragraph 11 recalls the Blue Guide's rule that placing on the market refers "to each individual product, not to a type of product". Paragraph 13 then adapts it to software, which "is not subject to physical production or stock limitations: each act of making the software available for download or distribution results in a new identical copy being created for the user". The conclusion: "As long as this version of the software is not modified in a way that affects compliance with the CRA, the placing on the EU market is to be considered to have occurred at the moment of the first offering for distribution or use."
Paragraph 14 states the rule in full, and it is worth quoting because it decides December 2027 for every software product already on sale: "a standalone software product with digital elements should be considered to have been placed on the market when its manufacturing phase is complete and that software is first supplied for distribution or use on the EU market in the course of a commercial activity. The manufacturer should be considered to have placed on the market multiple copies of the same software product with digital elements at the same time." The copies remain individual products, but "they are considered to be placed on the market at the same time, regardless of when possession or use of each individual copy is transferred". Example 1: version 1.0.0 first offered on 1 January 2028, one copy bought that day, another on 15 January; both were placed on the market on 1 January.
Two qualifications in the same paragraphs matter for a product line. First, variants are separate products: "where the manufacturer makes software available in different variants that differ in their included components, configurations or enabled functionalities (for example, builds for different operating systems or bundles with differing feature sets), those variants cannot be regarded as multiple copies of the same software product" and "should be treated as distinct products with digital elements for the purposes of placing on the market". Second, paragraph 15: "subsequent iterations of a software product with digital elements are considered as newly placed on the market when those iterations qualify as a 'substantial modification'", and "iterations that do not qualify as substantial modifications do not require the manufacturer to perform a new conformity assessment procedure and therefore do not modify that software's date of placement on the market". Example 2: version 1.0.1, not a substantial modification, bought on 30 January, is placed on the market on 1 January with version 1.0.0. Paragraph 16 limits all of this to standalone software; software combined with hardware follows section 2.4.
What this does to 11 December 2027
Put the two rules together with Article 69(2). A software product first offered before 11 December 2027 was placed on the market before that date, and so were all the copies customers download after it, for as long as the version on offer is not substantially modified. The Regulation's design and conformity duties do not reach it until the first substantial modification, and then, under paragraph 124 of the guidance, only the modified parts unless the product's security as a whole is affected. Article 14's reporting duty reaches it regardless, from 11 September 2026, as Article 69(3) says.
The FAQ's entry 7.2 is the hardware mirror image and is easy to misread for software. It says the Regulation "applies to individual products, and not product types", so a manufacturer that placed 10,000 routers on the market before 11 December 2027 need not bring them into compliance but "may not produce another 5,000 copies of that router and place them on the market after" that date. For a physical unit, each one is placed on the market when it is supplied. For a software version, paragraph 14 says the copies were all placed on the market with the first offering, so a download in 2028 of a version first offered in 2027 is not a new placing. What is a new placing is a new variant, a substantially modified version, or, under FAQ 1.4's smart-TV example, an update that "modifies the original intended functions".
Three things follow for a company with products already on sale. Record, for each product and each variant, the date the version currently on offer was first supplied, because that date is the one Article 69(2) reads. Keep the list of variants honest: a Windows build and a macOS build, a free tier and a paid tier with different features, are different products with their own dates and, later, their own files. And treat the roadmap between now and December 2027 as the last window in which a substantial modification is free of the conformity assessment, which is an argument for making the changes that change the product's boundaries before the date rather than after it.
Betas, archives, and software for your own use
Three FAQ entries close the remaining gaps. Article 4(3) lets manufacturers make available "unfinished software which does not comply with this Regulation, provided that the software is made available only for a limited period required for testing purposes with a visible sign clearly indicating that it does not comply with this Regulation and that it will not be available on the market for purposes other than testing"; FAQ 1.6 confirms that covers "alpha versions, beta versions or release candidates", and quotes Recital 37: such software should be released "only following a risk assessment", comply "to the extent possible", implement vulnerability handling "to the extent possible", and manufacturers "should not force users to upgrade to versions only released for testing purposes". A beta channel is allowed; a beta channel that is where the product lives is not.
Article 13(11) allows public software archives of historical versions, provided "users shall be clearly informed in an easily accessible manner about risks associated with using unsupported software" (FAQ 1.7). And FAQ 1.5, with Blue Guide section 2.2, keeps products manufactured only for the manufacturer's own use outside the Regulation: internal tools you never supply are not placed on the market.
What to write down
For each product and variant you supply to users: the form it takes on the user's side, and the paragraph 20 or 21 answer that follows; the date the current version was first offered on the EU market; the versions since, each marked as a substantial modification or not, under the four questions of paragraph 110; the test channels and their visible sign; and the archive of old versions and the warning on it. That page is the first section of the technical file for the products that need one, and the record that says why the others do not yet.
Sources
- Regulation (EU) 2024/2847, Article 3(1), (21) and (22), Article 4(3), Article 13(1) and (11), Article 69(2) and (3), Recitals 11, 12, 37 and 41.
- European Commission, Commission guidance on the application of Regulation (EU) 2024/2847, C(2026) 5252 final of 27 July 2026, Annex, sections 2.1 and 2.2, paragraphs 10 to 21 and examples 1 to 6; section 4.4.2, paragraph 124.
- European Commission, FAQs on the Cyber Resilience Act, version 1.4 of 4 September 2026, entries 1.4, 1.5, 1.6, 1.7, 7.2 and 7.5.
- European Commission, the Blue Guide on the implementation of EU product rules 2022, sections 2.2 and 2.3, as the guidance cites them.
This is not legal advice. Paragraphs 13 to 15 are half a page and the two examples are four lines; they are the half page that decides whether your existing product is inside the Regulation in December 2027.