Scope and classification

Product: COOK version 2.0.0 Manufacturer: Bilal El Homsi Generated: 2026-10-24 by cra-dossier 0.1.0 from the repository cook at commit cd17b114fbab Regulation: Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj

DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.

Answers used

Result

Verdict: in scope. Class: Default product: self-assessment.

• A hosted service that an installed product needs to perform one of its functions is a remote data processing solution and is part of that product (Article 3(1) and 3(2); recital 11 gives the example of a mobile app that needs an API or database provided by the manufacturer). The product is the app or device plus this service; the service alone is not assessed separately.
• Supplying it in the course of a commercial activity, whether for payment or free of charge, is making it available on the market (Article 3(22); recital 15 lists paid tiers, monetised services, ads-style monetisation, personal data as a condition of use, and donations beyond costs).
• The product has, or can reasonably be expected to have, a data connection to a device or network (Article 2(1); Article 3(8) to 3(10)).
• The core functionality is not one of the Annex III or Annex IV categories, so this is a default product: self-assessment under Article 32(1)(a) (internal control, Annex VIII, Part I). The European Commission’s CRA page names mobile applications and computer games as examples of this default route.
• Article 69(2): a product placed on the market before 11 December 2027 falls under the regulation only if it is substantially modified from that date (Article 3(30): a change that affects compliance with Annex I, Part I, or changes the intended purpose). Article 69(3): the Article 14 reporting duties apply from 11 September 2026 to every in-scope product already on the market. In practice, most actively maintained software ships a substantial modification at some point, so plan for the full obligations.
• A manufacturer established outside the EU is covered when its product is placed on the Union market (Article 3(13), Article 3(21)). It may appoint an authorised representative in the EU by written mandate (Article 18). An importer (Article 19) and distributors (Article 20) have their own duties: they must check that the conformity assessment, technical documentation, CE marking, declaration of conformity and Annex II information exist. Whether an app store is a distributor in your case is a question for the manufacturer and the Commission guidance C(2026) 5252; this check assumes nothing about it. Reporting under Article 14(7) goes to the CSIRT of the Member State determined by the authorised representative, importer, distributor or highest number of users, in that order.
• Microenterprises and small enterprises may provide the Annex VII technical documentation in a simplified format once the Commission adopts the implementing act under Article 33(5); none was found on 2026-10-24, so the full Annex VII structure is drafted now and can be condensed later. Article 32(6) requires reduced conformity-assessment fees for SMEs; Article 33(1) to (4) promises national awareness, a communication channel, testing support and advertised financial support.

Conformity assessment route

Internal control (module A) under Article 32(1)(a) and Annex VIII, Part I: the manufacturer draws up the Annex VII technical documentation, ensures design, development, production and vulnerability handling meet Annex I, affixes the CE marking and draws up the EU declaration of conformity on its sole responsibility. Modules B+C, H or a European cybersecurity certification scheme remain available (Article 32(1)(b) to (d)).

Definitions applied

• Article 3(1): a product with digital elements is a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately.
• Article 3(2): remote data processing is data processing at a distance for which the software is designed and developed by or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Recital 11: a mobile application that requires access to an API or database provided by a service developed by the manufacturer brings that service in as a remote data processing solution. Recital 12: websites that do not support a product’s functionality, and cloud services designed outside the manufacturer’s responsibility, are out; SaaS, PaaS and IaaS fall under Directive (EU) 2022/2555 (NIS2).
• Article 3(22): making available on the market means supply for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge. Recital 15: commercial activity includes charging a price, charging for technical support beyond cost recovery, an intention to monetise (for example a platform through which other services are monetised), requiring personal-data processing as a condition of use for reasons other than security, compatibility or interoperability, or accepting donations beyond costs.
• Article 3(13): a manufacturer develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge. Non-EU manufacturers are covered when their products are placed on the Union market; importers (Article 19) and distributors (Article 20) carry their own obligations, and an authorised representative may be appointed (Article 18).
• Article 7(1): products whose core functionality is a category listed in Annex III are important products; integrating such a component does not in itself make the whole product important. Commission Implementing Regulation (EU) 2025/2392 gives the technical description of each category.
• Article 69(2): products placed on the market before 11 December 2027 fall under the regulation only if substantially modified (Article 3(30)) from that date; Article 69(3): Article 14 reporting applies to all in-scope products placed on the market before that date.

Product facts from the repository

• Platforms: Expo / React Native, Android; ecosystems: npm, gradle.
• Identifiers: npm package name cook, expo slug cook, android package fun.cook.app, android versionCode 32, gradle applicationId fun.cook.app, gradle versionName (native project file; a managed build may override it) 0.1.0, gradle versionCode (native project file; a managed build may override it) 1.
• Distribution: Solana dApp Store (publisher config in dapp-store/config.yaml).
• Remote data processing solutions (Article 3(2)): The COOK worker at cook-metadata.bcrypto-eth.workers.dev (Cloudflare Workers with KV): serves token metadata and uploaded images for coins created in the app, runs the name check, grades Kitchen launches from on-chain facts and serves the feed. Without it the app cannot create coin metadata or show the feed, so it is a remote data processing solution of the product (Article 3(2); guidance C(2026) 5252 section 8). Third-party services the app calls but does not operate: Solana RPC providers, Meteora, Pump.fun, Jupiter and Bags APIs, OpenRouter (model gateway for generation), price and chart data providers..
• External hosts reached by the code (top 10 of 25): cookkitchen.fun, api.devnet.solana.com, pump.fun, solscan.io, openrouter.ai, cook-metadata.bcrypto-eth.workers.dev, arxiv.org, api.mainnet-beta.solana.com, solana-rpc.publicnode.com, jup.ag.

Penalties for context

Article 64(2): non-compliance with the essential requirements of Annex I or the obligations in Articles 13 and 14 carries administrative fines of up to EUR 15 000 000 or 2.5 % of worldwide annual turnover, whichever is higher; Article 64(3): other obligations up to EUR 10 000 000 or 2 %; Article 64(4): incorrect, incomplete or misleading information to notified bodies or authorities up to EUR 5 000 000 or 1 %.

This check applies the text of Regulation (EU) 2024/2847 and Commission Implementing Regulation (EU) 2025/2392 to your answers. It is not legal advice and makes no claim about conformity; borderline cases (remote data processing, open-source monetisation, app stores, substantial modification) are addressed in the Commission guidance C(2026) 5252 and may need a lawyer.