Short answer: yes, for most apps published by companies.

An app that users download and run on their phone is software "provided to and obtained by a user", which the Commission treats as a product with digital elements.

It is covered when it is made available in the EU in the course of a commercial activity. A price is not required: monetisation through ads, data or related services can be enough.

A website or web app used only in the browser is not covered on that basis alone, but the backend of an installed app can be.

Reporting of actively exploited vulnerabilities already applies, since 11 September 2026, to apps that are on the market today. Everything else applies from 11 December 2027.

What the regulation says

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847 , applies to "products with digital elements made available on the market" whose intended or reasonably foreseeable use includes a data connection to a device or network (Article 2(1)).…