CRA remote data processing — the product/service boundary
A cloud service label does not answer the CRA scope question. Necessary remote processing may be part of a product with digital elements.
Necessary function and responsibility
Describe the product function, the remote processing needed for it and the manufacturer's design or responsibility. Distinguish optional integrations from processing whose absence prevents a product function.
Architecture evidence
Retain data flows, interfaces, dependency descriptions and the operator responsible for the remote element. Review the commercial product as supplied, not only the local executable or device.
Changes and findings
Map remote-service changes and vulnerabilities to the affected product functions, versions and customers. Preserve uncertain boundaries for human review; neither all SaaS nor all cloud features automatically fall into one scope outcome.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.