Scope and classification

Product: Seeker Scout version 0.11.0 Manufacturer: Bilal El Homsi Generated: 2026-10-24 by cra-dossier 0.1.0 from the repository seeker-scout at commit 19267dd96bc8 Regulation: Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj

DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.

Answers used

Question	Answer
What are you placing on the market?	A hosted service that an installed product of yours (app, device) needs in order to perform one of its functions
Is it supplied in the course of a commercial activity?	Yes: it is sold, has paid tiers or in-app purchases, carries ads, monetises other services, requires personal data for reasons other than security or compatibility, or takes donations beyond costs
Does its intended or reasonably foreseeable use include any direct or indirect data connection to a device or network (internet, Bluetooth, USB, local network, APIs, files)?	Yes
Is the product already covered by one of these regimes?	None of these
Which of these is the core functionality of the product as a whole? (Having such a feature inside a product with a different core function does not count: Implementing Regulation (EU) 2025/2392, recitals 3 to 5.)	None of these: the core function is something else (for example a game, a news or shopping app, a wallet companion, a productivity or business app, a media player, a CMS plugin, a developer tool)
Will the product first be placed on the EU market before 11 December 2027?	Yes, it is on the market already or will be before that date
Where is the manufacturer established?	Outside the EU
Size of the manufacturer (Recommendation 2003/361/EC)	Micro: fewer than 10 staff and turnover or balance sheet of EUR 2 million or less

Result

Verdict: in scope. Class: Default product: self-assessment.

A hosted service that an installed product needs to perform one of its functions is a remote data processing solution and is part of that product (Article 3(1) and 3(2); recital 11 gives the example of a mobile app that needs an API or database provided by the manufacturer). The product is the app or device plus this service; the service alone is not assessed separately.
Supplying it in the course of a commercial activity, whether for payment or free of charge, is making it available on the market (Article 3(22); recital 15 lists paid tiers, monetised services, ads-style monetisation, personal data as a condition of use, and donations beyond costs).
The product has, or can reasonably be expected to have, a data connection to a device or network (Article 2(1); Article 3(8) to 3(10)).
The core functionality is not one of the Annex III or Annex IV categories, so this is a default product: self-assessment under Article 32(1)(a) (internal control, Annex VIII, Part I). The European Commission’s CRA page names mobile applications and computer games as examples of this default route.
Article 69(2): a product placed on the market before 11 December 2027 falls under the regulation only if it is substantially modified from that date (Article 3(30): a change that affects compliance with Annex I, Part I, or changes the intended purpose). Article 69(3): the Article 14 reporting duties apply from 11 September 2026 to every in-scope product already on the market. In practice, most actively maintained software ships a substantial modification at some point, so plan for the full obligations.
A manufacturer established outside the EU is covered when its product is placed on the Union market (Article 3(13), Article 3(21)). It may appoint an authorised representative in the EU by written mandate (Article 18). An importer (Article 19) and distributors (Article 20) have their own duties: they must check that the conformity assessment, technical documentation, CE marking, declaration of conformity and Annex II information exist. Whether an app store is a distributor in your case is a question for the manufacturer and the Commission guidance C(2026) 5252; this check assumes nothing about it. Reporting under Article 14(7) goes to the CSIRT of the Member State determined by the authorised representative, importer, distributor or highest number of users, in that order.
Microenterprises and small enterprises may provide the Annex VII technical documentation in a simplified format once the Commission adopts the implementing act under Article 33(5); none was found on 2026-10-24, so the full Annex VII structure is drafted now and can be condensed later. Article 32(6) requires reduced conformity-assessment fees for SMEs; Article 33(1) to (4) promises national awareness, a communication channel, testing support and advertised financial support.

Conformity assessment route

Internal control (module A) under Article 32(1)(a) and Annex VIII, Part I: the manufacturer draws up the Annex VII technical documentation, ensures design, development, production and vulnerability handling meet Annex I, affixes the CE marking and draws up the EU declaration of conformity on its sole responsibility. Modules B+C, H or a European cybersecurity certification scheme remain available (Article 32(1)(b) to (d)).

Definitions applied

Article 3(1): a product with digital elements is a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately.
Article 3(2): remote data processing is data processing at a distance for which the software is designed and developed by or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Recital 11: a mobile application that requires access to an API or database provided by a service developed by the manufacturer brings that service in as a remote data processing solution. Recital 12: websites that do not support a product’s functionality, and cloud services designed outside the manufacturer’s responsibility, are out; SaaS, PaaS and IaaS fall under Directive (EU) 2022/2555 (NIS2).
Article 3(22): making available on the market means supply for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge. Recital 15: commercial activity includes charging a price, charging for technical support beyond cost recovery, an intention to monetise (for example a platform through which other services are monetised), requiring personal-data processing as a condition of use for reasons other than security, compatibility or interoperability, or accepting donations beyond costs.
Article 3(13): a manufacturer develops or manufactures products with digital elements, or has them designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge. Non-EU manufacturers are covered when their products are placed on the Union market; importers (Article 19) and distributors (Article 20) carry their own obligations, and an authorised representative may be appointed (Article 18).
Article 7(1): products whose core functionality is a category listed in Annex III are important products; integrating such a component does not in itself make the whole product important. Commission Implementing Regulation (EU) 2025/2392 gives the technical description of each category.
Article 69(2): products placed on the market before 11 December 2027 fall under the regulation only if substantially modified (Article 3(30)) from that date; Article 69(3): Article 14 reporting applies to all in-scope products placed on the market before that date.

Product facts from the repository

Platforms: Expo / React Native, Android; ecosystems: npm.
Identifiers: npm package name seeker-scout, expo slug seeker-scout, android package com.bilal.seekerscout, android versionCode 14.
Distribution: Solana dApp Store (publisher Seeker Scout, package com.bilal.seekerscout), live since 2026-07-14..
Remote data processing solutions (Article 3(2)): Two services operated by the manufacturer are needed for the app's functions and are therefore remote data processing solutions (Article 3(2); guidance C(2026) 5252 section 8): the catalog JSON published to seeker-scout-catalog.pages.dev (Cloudflare Pages, refreshed daily by an indexer that reads the dApp Store catalog) and the lounge worker at seeker-lounge.bcrypto-eth.workers.dev (Cloudflare Workers) that verifies wallet signatures, stores vouches and replies, serves the Alpha digest and receives a once-a-day open ping per install. Third-party services the app reads but does not operate: Solana Mobile dApp Store asset hosts, the public Solana RPC endpoint, and the Staked SKR program..
External hosts reached by the code (top 7 of 7): seeker-scout-catalog.pages.dev, seeker-lounge.bcrypto-eth.workers.dev, api.mainnet-beta.solana.com, seekertracker.com, solanamobile.com, stake.solanamobile.com, seekerscout.com.

Penalties for context

Article 64(2): non-compliance with the essential requirements of Annex I or the obligations in Articles 13 and 14 carries administrative fines of up to EUR 15 000 000 or 2.5 % of worldwide annual turnover, whichever is higher; Article 64(3): other obligations up to EUR 10 000 000 or 2 %; Article 64(4): incorrect, incomplete or misleading information to notified bodies or authorities up to EUR 5 000 000 or 1 %.

This check applies the text of Regulation (EU) 2024/2847 and Commission Implementing Regulation (EU) 2025/2392 to your answers. It is not legal advice and makes no claim about conformity; borderline cases (remote data processing, open-source monetisation, app stores, substantial modification) are addressed in the Commission guidance C(2026) 5252 and may need a lawyer.