Independent information resource Product security · EU CRA
CRA scope / 16

When Is Software Considered Placed on the EU Market?

Understand when software is placed on the Union market under the Cyber Resilience Act, including first making available, digital distribution, free downloads, commercial activity, software versions and testing releases.

IN BRIEF

Placing on the market is the first commercial making available of the software product on the Union market. Subsequent supply is making available rather than the initial placing. Price is not decisive, and software can be supplied digitally. Teams should identify the actual product, release, manufacturer and first Union-market supply event.

01 / 09

Placing on the Market Means the First Making Available

Article 3 defines placing on the market as the first making available of a product with digital elements on the Union market. The definition is therefore linked to another CRA concept, making available on the market. For a software manufacturer, identifying the relevant first supply event is important because several manufacturer obligations are tied directly to placing the product on the market.

02 / 09

Making Available Means Commercial Supply for Distribution or Use

The CRA defines making available as supplying a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge. The concepts of supply, Union-market use and commercial activity therefore need to be considered together. Merely developing software is different from supplying the resulting product.

03 / 09

Software Does Not Need a Physical Shipment

Software is commonly supplied by download, marketplace distribution, package delivery, licence activation or other electronic mechanisms. The CRA includes software products directly, so market analysis should not depend on whether a physical disk, device or box crosses a border. Teams should record when and how EU users or distributors first receive the software product.

04 / 09

A Marketplace Release Can Be Relevant

Publishing commercial software through an application marketplace, vendor download portal or other distribution channel can be relevant to making the product available on the Union market. The manufacturer should identify the product version being released, the territory in which it is offered and the entity under whose name or trademark the product is marketed.

05 / 09

Free of Charge Can Still Be Market Supply

The Article 3 definition expressly states that making available can occur whether the product is supplied for payment or free of charge. A free download used to support a commercial product, platform or business model therefore cannot be assumed to fall outside the CRA solely because the user pays nothing. Free and open-source software has additional specific rules that need to be considered separately.

06 / 09

Placing and Making Available Are Not Synonyms

Placing on the market is the first making available of the product on the Union market. Later supplies of that product can still be making available without being the original placing event. This distinction is useful for manufacturers, importers and distributors because CRA obligations can attach differently depending on the operator's role and the stage of the supply chain.

07 / 09

Software Versions Need Product-Level Analysis

Software changes continuously, but not every patch should automatically be described as an entirely new CRA product placed on the market. The Regulation specifically recognises subsequent substantially modified versions of software products in Article 13. Teams should maintain version records and assess whether a release is ordinary maintenance, a security update, a substantial modification or a separately marketed product version rather than using a single rule for every release.

08 / 09

Testing Releases Receive Specific Treatment

Article 4 contains specific treatment for unfinished software such as alpha versions, beta versions or release candidates made available for a limited period for testing. The CRA allows such testing software to be made available under stated conditions even before ordinary conformity, including clear indication that the software does not comply and is available only for testing. This should not be confused with an unrestricted production release.

09 / 09

Market Placement Should Be a Recorded Compliance Event

For each software product, maintain a record of the manufacturer, product and version identity, intended purpose, distribution channel, first Union-market availability date, territories, conformity evidence and subsequent material releases. This turns the abstract placing-on-the-market concept into a product lifecycle event that can be tied to technical documentation and release governance.

REFERENCE DESK

Official sources

Read the full legal text and Commission material for precise wording, qualifications and updates.

Editorial review: 26 September 2026. Regulatory material can change; follow the official sources for current guidance.