Does the Cyber Resilience Act Apply to AI Startups?
Learn if the EU CRA applies to AI Startups, what the core compliance requirements are, and how to start preparing your engineering teams automatically.
Core Definition
It Depends. Software you supply to customers (downloaded, installed, on-premise or as a mobile/desktop client) is a product with digital elements (Article 3(1)), together with the remote data processing it needs to perform its functions (Article 3(2)). A service provided only as hosted software (SaaS) is not in scope on its own: Recital 12 notes that Directive (EU) 2022/2555 (NIS2) applies to cloud services such as SaaS. An AI model shipped inside a downloadable app, SDK or device is part of a product with digital elements; the same model offered only through a hosted API is a service, which Recital 12 places under NIS2 rather than the CRA. Confirm which parts of your offering are placed on the EU market as products, and whether a sector-specific exclusion applies, before assuming the CRA's requirements do or do not apply.
Key Compliance Steps for AI Startups
- Determine Classification: Check if your AI Startups falls under the default category, an important class (Annex III, class I or II) or the critical list (Annex IV), which dictate stricter conformity assessment paths.
- Perform Risk Assessment: Map out the attack surface for your software and document the mitigations for the "secure by design" requirement.
- Implement Vulnerability Reporting: Provide a 24-hour reporting mechanism to ENISA for actively exploited vulnerabilities.
- Generate an SBOM: Ensure all dependencies used in your AI Startups are documented in a machine-readable Software Bill of Materials.
- Avoid the Common Pitfall: Founders conflate AI Act obligations (model risk) with CRA obligations (product cybersecurity) — you need both, not one instead of the other.
How This Plays Out in Practice
An AI model shipped inside a downloadable app, SDK or device is part of a product with digital elements; the same model offered only through a hosted API is a service, which Recital 12 places under NIS2 rather than the CRA.
What to Watch For
Founders conflate AI Act obligations (model risk) with CRA obligations (product cybersecurity) — you need both, not one instead of the other.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to AI Startups.