Does the Cyber Resilience Act Apply to Edtech Platforms?
Learn if the EU CRA applies to Edtech Platforms, what the core compliance requirements are, and how to start preparing your engineering teams automatically.
Core Definition
It Depends. Software you supply to customers (downloaded, installed, on-premise or as a mobile/desktop client) is a product with digital elements (Article 3(1)), together with the remote data processing it needs to perform its functions (Article 3(2)). A service provided only as hosted software (SaaS) is not in scope on its own: Recital 12 notes that Directive (EU) 2022/2555 (NIS2) applies to cloud services such as SaaS. A classroom app processing children's data combines CRA product-security duties with heightened GDPR scrutiny — a breach triggers both regimes simultaneously. Confirm which parts of your offering are placed on the EU market as products, and whether a sector-specific exclusion applies, before assuming the CRA's requirements do or do not apply.
Key Compliance Steps for Edtech Platforms
- Determine Classification: Check if your Edtech Platforms falls under the default category, an important class (Annex III, class I or II) or the critical list (Annex IV), which dictate stricter conformity assessment paths.
- Perform Risk Assessment: Map out the attack surface for your software and document the mitigations for the "secure by design" requirement.
- Implement Vulnerability Reporting: Provide a 24-hour reporting mechanism to ENISA for actively exploited vulnerabilities.
- Generate an SBOM: Ensure all dependencies used in your Edtech Platforms are documented in a machine-readable Software Bill of Materials.
- Avoid the Common Pitfall: Treating privacy compliance (like COPPA-style consent flows) as covering cybersecurity obligations, which the CRA addresses separately.
How This Plays Out in Practice
A classroom app processing children's data combines CRA product-security duties with heightened GDPR scrutiny — a breach triggers both regimes simultaneously.
What to Watch For
Treating privacy compliance (like COPPA-style consent flows) as covering cybersecurity obligations, which the CRA addresses separately.
Common Questions
Which Annex I requirements matter most for classroom software that handles pupils' data?
Where applicable, Annex I Part I, point (2)(g) requires a product to process only data that are adequate, relevant and limited to what is necessary for its intended purpose (data minimisation), and points (2)(e) and (2)(f) require protecting the confidentiality and integrity of stored, transmitted or otherwise processed data. These requirements attach to the product you supply, such as an installed app or client.
Does this apply if we only run a hosted service?
Software you supply to customers (downloaded, installed, on-premise or as a mobile/desktop client) is a product with digital elements (Article 3(1)), together with the remote data processing it needs to perform its functions (Article 3(2)). A service provided only as hosted software (SaaS) is not in scope on its own: Recital 12 notes that Directive (EU) 2022/2555 (NIS2) applies to cloud services such as SaaS.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to Edtech Platforms.