Answer the questions and see the reasoning.
The app is software supplied to the user
The Commission guidance specifically identifies an app downloaded from an app store and installed on a smartphone as a software product. Commercial context, relevant data connections and exclusions still need checking.
A free companion app supplied with a paid device or a monetised app is not necessarily non-commercial. App-store distribution does not remove the need to identify the manufacturer marketing the product under its name or trademark.
Three common mobile scenarios
An ordinary commercial note-taking app will often follow the Default category, subject to checking its complete core functionality. A standalone password manager may match Important Class I instead.
A mobile app that requires a manufacturer-controlled cloud function needs the remote processing assessment. An app that is genuinely a regulated medical device requires checking the precise medical-device exclusion; being used by a clinician is not enough.
Evidence for the app manufacturer
Record supported app versions, product and backend boundaries, dependency due diligence and security risks. An embedded browser or operating-system capability provided by the phone does not automatically determine the app’s category.
Plan secure update distribution, vulnerability handling and user information. Assess material changes to the app’s purpose and security behaviour when releasing updates; a new version number alone does not establish a substantial modification.
Dates and next actions
Article 14 reporting for manufacturers applies from 11 September 2026, including to older in-scope products. Most requirements apply from 11 December 2027, subject to the rules for products already placed on the market and subsequent substantial modifications.
If you are the manufacturer of an in-scope product, establish the product risk assessment, support-period decision, vulnerability handling and technical documentation. Select the applicable conformity route before making a compliance claim. A reseller should use the importer and distributor assessment for its distinct duties.
Frequently asked questions
Does Apple or Google become the manufacturer of every app?
Do not infer the economic role merely from the app store. Assess who develops or commissions the app and markets it under their name, together with the distribution arrangement.
Does an offline app escape the CRA?
Not automatically. The CRA includes direct and indirect connections to another device or network. Analyse the actual software and host-system relationship.