When In-House Developments Fall under the CRA
“This doesn't affect us, we don't even sell the software.” Compliance managers often hear this when the Cyber Resilience Act (CRA) comes up in connection with products developed in-house. The view is understandable, but in many cases it falls short. The CRA does not depend on a classic product sale. It depends on making available on the market, and that concept is broader than many assume.
Contents
What the CRA means by “making available on the market”
The CRA defines the term as the supply of a product for distribution or use on the Union market in the course of a commercial activity. Whether this happens in return for payment or free of charge makes no difference.
Two criteria therefore decide: the product is supplied to a third party, and this happens in the course of a commercial activity. Take a software tool that you develop solely for your own operations and run on your own systems. If you do not make it available to any third party, it generally falls outside the scope of the CRA. This reading is consistent with the EU Blue Guide, the reference document for applying EU product legislation.
So much for the theory. In practice, the line between “purely internal” and “made available on the market” is blurrier at many manufacturers than it first appears.
Borderline cases: when in-house developments become relevant under the CRA
There are several situations in which products developed in-house leave the area of purely internal use, often without anyone involved noticing. We see the following scenarios regularly in our consulting work.
Supply within a group of companies
One of the most common borderline cases is supply within a group. A company develops control software, a diagnostic tool, or a machine component and provides it to a subsidiary or a sister company. Although the supply takes place within the group, legally it is a transaction between two separate legal entities. If the supply happens in the course of a commercial activity, which is usually the case for intra-group supplies, it counts as making available on the market under the CRA.
This applies whether or not money changes hands. Providing a product free of charge to a legally separate group company can also meet the definition.
Software components in products you sell
Another relevant case: a manufacturer develops a software module in-house, such as a communication library, a diagnostic protocol, or a firmware component. It integrates the module into a product that it then delivers to customers. The component itself is never marketed separately, but it reaches the market as part of the product sold.
In this situation, the whole product, including all integrated components, is made available on the market. The manufacturer must therefore ensure that in-house components also meet the essential cybersecurity requirements of the CRA. This applies in particular to the requirements for design, development, and production listed in Annex I, Part I.
Customer portals, cloud services, and interfaces
Many manufacturers offer their customers digital services developed in-house: service portals for remote maintenance, cloud-based data platforms, configurators, or APIs. Even if these applications are never sold as a separate product, providing them to customers can count as making available on the market.
This becomes especially relevant when the software qualifies as a remote data processing solution under the CRA. That means data processing at a distance for which the manufacturer is responsible and without which the product could not perform one of its functions. In this case, the remote component is treated as part of the product with digital elements.
Software provided free of charge
The CRA expressly covers products provided free of charge, as long as this happens in the course of a commercial activity. A manufacturer that offers customers a free download of a diagnostic or configuration tool developed in-house places that product on the market under the CRA. Being free of charge does not, on its own, rule out the CRA.
Comparison with the Machinery Regulation
The Machinery Regulation (Regulation (EU) 2023/1230), which applies from January 2027, is an interesting comparison. It deals with in-house manufacture much more clearly. If you manufacture machinery or a related product for your own use, you count as a manufacturer and are subject to the corresponding obligations, including conformity assessment and CE marking.
The CRA follows a different logic here. It does not depend on manufacture as such, but on making a product available on the market. The mere fact that a company developed a piece of software or a device itself does not create obligations under the CRA. What matters is whether and how the product is made available to third parties.
For manufacturers that develop both machinery and digital products in-house, the same situation can therefore be assessed differently depending on which set of rules applies. This divergence makes a careful case-by-case assessment unavoidable.
Why a blanket assessment is risky
The examples show that there is no general yes or no to whether in-house products fall under the CRA. It depends on how the product is used, passed on, and embedded in the market.
Many manufacturers do not have a full overview of which in-house developments end up in contexts relevant to the CRA. This applies in particular to:
- software libraries reused across several product lines
- tools originally built for internal use and later made available to customers
- remote data processing components that are functionally tied to products you sell
Ready for the CRA?
The examples show that in-house developments are relevant to the CRA more often than many manufacturers assume. Our CRA readiness check shows how well your company is prepared for this. In a few minutes, you get an assessment of your current maturity.
Conclusion
The CRA does not cover every piece of software or machinery developed in-house, but it covers much more than many manufacturers first assume. Intra-group supplies, components embedded in products, and services provided to customers often fall within its scope.
Unlike the Machinery Regulation, which addresses in-house manufacture explicitly, the CRA starts from the act of making a product available. That makes the case-by-case assessment more complex, but no less relevant. Manufacturers should check their in-house developments systematically for CRA relevance. The reporting obligations have applied since September 2026, and the CRA applies in full from December 2027.
Want an assessment of your situation?
Not every situation can be assessed in general terms. In a no-obligation first call, we look at your specific situation and identify sensible next steps.
