Commercial desktop software supplied for local execution on the EU market is likely within CRA scope if the connectivity criteria are met and no exclusion applies. The programming language or installer format does not decide the result.
Apply this to your product

Answer the questions and see the reasoning.

Open scope & role

Local execution is the relevant distinction

Software packaged with web technologies but installed locally remains a supplied software product. The guidance explicitly distinguishes this from an application accessed exclusively through a browser.

A perpetual licence, subscription and free commercial companion client are different sales arrangements, but none is an automatic scope exclusion. Identify the supplied version and the responsible economic operator.

Articles 2 and 3; guidance section 2.2, examples 4–5CRA text Commission guidance

Classify what the application principally does

A general-purpose drawing or accounting application may be Default. An operating system, malware-protection tool or password manager can match Important Class I. A firewall or qualifying hypervisor can match Class II.

A conventional app does not automatically inherit the category of an embedded browser, cryptographic library or operating system it uses. Evaluate the whole product against the technical descriptions.

Annex III; Regulation 2025/2392, recitals 3–5Implementing Regulation (EU) 2025/2392 CRA text

Desktop client plus a required backend

If a supplier-controlled backend is needed for one of the client’s functions, it may form part of the product as remote data processing. Document what happens without the service and which entity is responsible for its design and development.

Plan vulnerability handling and updates for supported releases, and document how users learn the support end date. Changes to security-relevant behaviour or intended purpose require a modification assessment; routine repairs are not automatically substantial.

Articles 3(2), 3(30) and 13; guidance sections 4, 5 and 8CRA text Commission guidance

Dates and next actions

Article 14 reporting for manufacturers applies from 11 September 2026, including to older in-scope products. Most requirements apply from 11 December 2027, subject to the rules for products already placed on the market and subsequent substantial modifications.

If you are the manufacturer of an in-scope product, establish the product risk assessment, support-period decision, vulnerability handling and technical documentation. Select the applicable conformity route before making a compliance claim. A reseller should use the importer and distributor assessment for its distinct duties.

Articles 13, 14, 19–20, 32, 69 and 71CRA text ↗

Frequently asked questions

Is an Electron application treated as SaaS?

Packaging web technologies into a locally supplied executable does not make it pure SaaS. Assess the local product and any covered backend.

Does a subscription change the product category?

The category depends on core functionality. The subscription is relevant to commercial supply, not by itself to Class I, Class II or Critical classification.

This guide supports an initial assessment. Your result depends on the product facts and the applicable measures. Read how to use this guidance.