Software can be a product with digital elements. The practical starting point is to define the marketed product and test the legal scope criteria, not to treat every software project identically.
Define what is supplied
Record the application, separately marketed components and any remote data-processing solution that is necessary for a product function. Identify the party marketing it under its name.
Trace connections and market activity
Review intended and reasonably foreseeable data connections, EU market availability and commercial activity. Open-source distribution and sectoral exclusions require their own analysis.
Carry the boundary into implementation
Use the product definition consistently for risk assessment, components, vulnerability handling and technical documentation.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.