Who is responsible for your digital service offering?

Often, the app was developed by an external provider. It may even be a white-label solution used by several firms. But to the client, it is the firm's app, carrying the firm's name and brand.

Under the EU Cyber Resilience Act (CRA), that detail can matter.

The CRA applies to "products with digital elements," and a downloadable mobile app is typically one of them. Responsibility rests with the "manufacturer," and an organisation that places a product on the market under its own name may be treated as the manufacturer, even if someone else wrote the code.

By contrast, an online portal that clients access only through a web browser is generally outside the CRA's scope. That's why two firms offering similar services may find themselves in quite different positions.

A few questions worth considering:

-Do we offer clients an app, installable software or a device?
-Is it released under our name?
-Who is responsible for its security updates, and for how long?
-Do our agreements with the developer reflect this?

For many firms, the answers will be straightforward. For others, they may point to responsibilities that weren't obvious at first.

If your firm offers clients an app, we'd be glad to help you consider whether the CRA applies and what it would mean in practice.