Does the Cyber Resilience Act Apply to Marketing Automation Tools?
Learn if the EU CRA applies to Marketing Automation Tools, what the core compliance requirements are, and how to start preparing your engineering teams automatically.
Core Definition
It Depends. Software you supply to customers (downloaded, installed, on-premise or as a mobile/desktop client) is a product with digital elements (Article 3(1)), together with the remote data processing it needs to perform its functions (Article 3(2)). A service provided only as hosted software (SaaS) is not in scope on its own: Recital 12 notes that Directive (EU) 2022/2555 (NIS2) applies to cloud services such as SaaS. A marketing platform holding large contact lists and email credentials is a common breach target even though it's rarely thought of as security-critical software. Confirm which parts of your offering are placed on the EU market as products, and whether a sector-specific exclusion applies, before assuming the CRA's requirements do or do not apply.
Key Compliance Steps for Marketing Automation Tools
- Determine Classification: Check if your Marketing Automation Tools falls under the default category, an important class (Annex III, class I or II) or the critical list (Annex IV), which dictate stricter conformity assessment paths.
- Perform Risk Assessment: Map out the attack surface for your software and document the mitigations for the "secure by design" requirement.
- Implement Vulnerability Reporting: Provide a 24-hour reporting mechanism to ENISA for actively exploited vulnerabilities.
- Generate an SBOM: Ensure all dependencies used in your Marketing Automation Tools are documented in a machine-readable Software Bill of Materials.
- Avoid the Common Pitfall: Third-party tracking pixel integrations expand the attack surface in ways that never get reviewed because they're treated as a marketing decision, not an engineering one.
How This Plays Out in Practice
A marketing platform holding large contact lists and email credentials is a common breach target even though it's rarely thought of as security-critical software.
What to Watch For
Third-party tracking pixel integrations expand the attack surface in ways that never get reviewed because they're treated as a marketing decision, not an engineering one.
Common Questions
How does Annex I treat third-party integrations such as tracking pixels?
Where applicable, Annex I Part I, point (2)(j) requires a product to be designed, developed and produced to limit attack surfaces, including external interfaces, and point (2)(g) requires processing only the data that are necessary for its intended purpose. Annex I Part II, point (6) also covers sharing information about potential vulnerabilities in third-party components.
Does this apply if we only run a hosted service?
Software you supply to customers (downloaded, installed, on-premise or as a mobile/desktop client) is a product with digital elements (Article 3(1)), together with the remote data processing it needs to perform its functions (Article 3(2)). A service provided only as hosted software (SaaS) is not in scope on its own: Recital 12 notes that Directive (EU) 2022/2555 (NIS2) applies to cloud services such as SaaS.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to Marketing Automation Tools.