<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>CRA Kit blog</title><link>https://crakit.eu/blog/</link><description>Short, practical notes on the EU Cyber Resilience Act for small software makers: scope, SBOM, reporting, documentation. New posts as the rules move.</description><language>en</language><item><title>You run a SaaS and ship an app? The CRA looks at the app</title><link>https://crakit.eu/blog/saas-with-an-app/</link><guid>https://crakit.eu/blog/saas-with-an-app/</guid><pubDate>Wed, 09 Sep 2026 08:00:00 +0000</pubDate><description>A browser-only SaaS is outside the Cyber Resilience Act. Add a mobile app, a desktop client or a device that needs your servers, and the picture changes. Here is where the line is, with the article references.</description></item></channel></rss>
