Internally developed products do not automatically fall under the CRA, but in many cases they do. This article explains where the boundary for placing products on the market lies.
The CRA defines the term as the delivery of a product for distribution or use on the Union market in the context of an economic activity, regardless of whether this is for payment or free of charge.
Two criteria are decisive: the product is made available to a third party, and this occurs in the context of a commercial activity. A company that develops a software tool exclusively for its own operations, runs it on its own systems and does not make it accessible to any third party, is in principle not within the scope of the CRA. This interpretation is in line with the EU Blue Guide (https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=OJ:C:2022:247:FULL), which serves as a guidance document for the application of EU product regulations.
In theory, that is. In practice, however, the boundaries between “purely internal” and “placed on the market” are often more fluid for many manufacturers than initially assumed.
Borderline cases when internal developments become CRA relevant
In practice there are a number of constellations in which internally developed products leave the realm of pure in-house use, often without the parties involved being aware of it. The following scenarios regularly appear in our advisory practice.
Transfer within a corporate group
One of the most common borderline cases concerns intra-group transfers. A company develops control software, a diagnostic tool or a machine component and makes it available to a subsidiary or a sister company. Although the transfer takes place within the corporate group, it is legally a transaction between two independent legal persons. If this transfer occurs in the context of an economic activity (which is usually the case for intra-group deliveries), it constitutes placing on the market within the meaning of the CRA.
This applies regardless of whether a payment is made. A free-of-charge transfer to a legally independent group company can also meet the criterion.
Software components in products sold to customers
Another relevant case: a manufacturer internally develops a software module (for example a communication library, a diagnostic protocol or a firmware component) and integrates it into a product that is then delivered to customers. Although the component itself is never marketed separately, it nonetheless reaches the market as part of the sold product.
In this constellation the complete product including all integrated components is placed on the market. The manufacturer must therefore ensure that internally developed parts also meet the CRA’s essential cybersecurity requirements. This specifically concerns the design, development and production requirements listed in Annex I Part I.
Customer portals cloud services and interfaces
Many manufacturers offer digitally developed services to their customers: service portals for remote maintenance, cloud-based data platforms, configurators or API interfaces. Even if these applications are never sold as standalone products, making them available to customers can constitute placing them on the market.
This becomes particularly relevant when the software qualifies as remote data processing under the CRA, i.e. data processing that is the manufacturer’s responsibility and whose absence would impair a function of the product. In that case the remote component is regulated as part of the product with digital elements.
Software provided free of charge
The CRA explicitly also covers products that are provided free of charge, provided this takes place in the context of an economic activity. A manufacturer who makes an internally developed diagnostic or configuration tool available to customers as a free download thus places that product on the market within the meaning of the CRA. The absence of a charge alone does not exclude applicability.
Comparison with the machinery regulation
An interesting comparison is the Machinery Regulation Machinery regulation (EU) 2023/1230, which will be binding from January 2027. There the issue of self-manufacture is regulated much more clearly: anyone who manufactures a machine or an associated product for their own use is considered a manufacturer and is subject to the corresponding obligations, including conformity assessment and CE marking.
The CRA follows a different logic. It is not tied to manufacturing as such, but to placing on the market. That means the mere fact that a company developed software or a device in-house does not by itself give rise to CRA obligations. What matters is whether and how the product is made accessible to third parties.
For manufacturers who develop both machines and digital products in-house, this results in different regulatory assessments of the same facts depending on which set of rules applies. This divergence makes a careful case-by-case assessment indispensable.
Why a blanket assessment is risky
The examples show that the question of whether internally developed products fall under the CRA cannot be answered with a simple yes or no. It depends on how the product is used, transferred and embedded in the market.
Many manufacturers do not have a complete overview of which internal developments ultimately end up in CRA-relevant contexts. This particularly affects software libraries reused across multiple product lines, tools that were originally developed for internal use and later made available to customers, and remote data processing components functionally coupled to sold products.
Ready for the CRA?
The examples show that internal developments are more often CRA relevant than many manufacturers assume. How well your company is prepared for this can be shown by our CRA-Readiness-Check — in a few minutes you will receive an assessment of your current maturity level.
Conclusion
The CRA does not cover every internally developed piece of software or machine, but it covers considerably more than many manufacturers initially assume. In particular, intra-group transfers, components embedded in products and customer-facing services frequently fall within the scope of the regulation.
Unlike the machinery regulation, which explicitly addresses self-manufacture, the CRA focuses on the act of placing on the market. That makes the assessment more complex on a case-by-case basis, but no less important. Manufacturers are well advised to systematically review their internal developments for CRA relevance before the reporting obligations apply from September 2026 and full applicability from December 2027.
Want an individual assessment?
Not every constellation can be classified in general terms. In a non-binding initial consultation we examine your specific situation and identify the next sensible steps.
