Five cases that decide if the CRA calls you a manufacturer
Freelance work, a free tier, a browser-only SaaS, a repo on GitHub, a non-EU seller. Where the CRA stops, with the article for each answer.
The reporting duties start today. GitLab published a piece on the 24-hour deadline this morning, and Startup Fortune ran one too, both dated 11 September 2026. Both cover what you send and when, and the question that comes before that one is whether the Cyber Resilience Act calls you a manufacturer at all.
Five setups produce most of the doubt. Here they are, with the article that settles each one.
The definition in one line
Article 3(13) says a manufacturer develops or manufactures a product with digital elements, or has it developed, and places it on the market under their own name or trademark. For payment, free of charge, or monetised. All three count.
Article 3(22) adds the filter. The activity has to be commercial. Article 3(1) defines the product with digital elements itself.
You work alone
A manufacturer does not have to be a company. One person who sells a plugin, an app, a theme or a command line tool under their own name falls under Article 3(13). No headcount in the definition, no revenue floor.
Size changes one thing, and it changes it later. Article 64(10)(a) says micro and small enterprises face no fine for missing the 24-hour early warning deadline on its own. The duty stays. Article 64 applies from 11 December 2027 in any case.
Your software is free
Free of charge sits inside Article 3(13). A price tag is one route into scope among three. Recital 18 puts free and open source software outside the regulation when it is supplied outside a commercial activity.
Take a common setup. A developer ships a free plugin on a public marketplace and a paid pro version built on the same core. The paid version carries the commercial activity. The free one shares the code.
Read Article 3(13) next to Recital 18, then write down which artefact you place on the market under your name. That sentence is the answer for both versions.
Your product runs in the browser
Pure SaaS in a browser sits outside the scope under Recital 12. NIS2 can apply instead, and only above its own sector and size thresholds.
Two details move the answer. Article 3(2) defines remote data processing. And if a user installs anything from you, a desktop client, a mobile app, an agent, a CLI, that artefact stands on its own as a product with digital elements.
Your code is on GitHub
A public repository, no price, no company behind it. Recital 18 keeps that outside the regulation.
Two things shift the line. A commercial activity around the project brings Article 3(13) back. And Article 24 sets a lighter regime for the open source software steward, with no fine attached under Article 64(10)(b).
You sell from outside the EU
The definition does not change at the border. Article 18 makes the authorised representative optional for a manufacturer established outside the Union.
What applies today, what waits
Article 14 applies from today, 11 September 2026. Early warning within 24 hours, full notification within 72 hours, counted from the moment you become aware. The recipients are the CSIRT designated as coordinator in your member state, and ENISA. The ENISA single reporting platform becomes operational today under Article 16.
The rest waits for 11 December 2027. Essential requirements in Annex I, vulnerability handling including the SBOM, technical documentation in Annex VII, the EU declaration of conformity in Annex V, the CE marking, and the penalties in Article 64.
One date question follows from the scope work above. Article 69 covers products already on the market before 11 December 2027. Article 14 applies to them. The rest applies only on substantial modification, and Recital 39 excludes security updates and bug fixes from that.
Fifteen minutes with a pen
Write three lines. What you place on the market under your own name. Whether money changes hands anywhere around it. Whether a user installs anything.
Those three answers cover the five cases above. Most founders can finish them over one coffee, and the edge cases usually come down to the second line.
If you want the article references sitting next to your answers, the free scope test walks eight questions and writes them out: https://crakit.eu/scope/
It returns a written, indicative assessment with the article numbers. Not a verdict.
The countdown on Article 14 starts when you become aware, not when an authority writes to you. That is the reason the scope question is worth an afternoon now, while nothing is on fire.
Not legal advice.
This is not legal advice.