Does giving the product away protect us?

No. The definition expressly puts paid and free supply on the same footing. Free editions, trial versions and ad-funded products are covered. What counts is not the price but the commercial context.

What does “in the course of a commercial activity” mean?

It separates private supply from business supply. A private individual publishing a program they wrote is not making it available within the meaning of the regulation. As soon as a commercial purpose is pursued, even indirectly through reach, reputation or an associated offering, the classification tips.

Is transferring within a group of companies a making available?

The regulation turns on supply for distribution or use on the Union market. Purely internal use within your own company is typically not a making available. Once the product goes to a different legal entity (including an affiliated one), the line is no longer clear-cut and the assessment belongs in writing.

Cyber Resilience Act

Making available on the market

Legal definition Art. 3(22) CRA

“the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge”

Regulation (EU) 2024/2847, Art. 3(22) CRA

While Placing on the market happens only once, making available describes every supply of a product on the Union market. The first such act is also the placing on the market; every subsequent one is only a making available.

The definition contains three elements worth testing separately: the supply, the purpose (distribution or use), and the commercial context.

Price is irrelevant

The reach of the term is clearest in its explicit equation of paid and free supply. Offering your product for nothing does not take it outside the regulation.

This matches the definition of Manufacturer, which likewise covers marketing “for payment, monetisation or free of charge”. Both aim at the same thing: the Cyber Resilience Act (CRA) should not be avoidable by formally giving a product away.

The real boundary is commercial activity

What actually limits scope is the phrase “in the course of a commercial activity”. It separates business conduct from private conduct.

In practice this is the hardest test, particularly in the open-source world. The CRA has its own answer there: it recognises the open-source software steward as a separate role with markedly lighter obligations, and states expressly that such a steward is not a manufacturer.

Why the distinction matters

Different obligations hang on the two terms:

Placing on the market triggers conformity assessment, technical documentation, the EU declaration of conformity and CE marking.
Making available carries the duties of the Distributor: verify the marking is present and the required documents exist, and act with due care.

Anyone holding both roles, such as a manufacturer that also sells directly to end customers, meets both sets of duties. That does not make them apply twice over: placing on the market happens once, making available continuously.

Practical questions

: No. The definition expressly puts paid and free supply on the same footing. Free editions, trial versions and ad-funded products are covered. What counts is not the price but the commercial context.
: It separates private supply from business supply. A private individual publishing a program they wrote is not making it available within the meaning of the regulation. As soon as a commercial purpose is pursued, even indirectly through reach, reputation or an associated offering, the classification tips.
: The regulation turns on supply for distribution or use on the Union market. Purely internal use within your own company is typically not a making available. Once the product goes to a different legal entity (including an affiliated one), the line is no longer clear-cut and the assessment belongs in writing.

This glossary is for orientation and does not constitute legal advice. The wording of Regulation (EU) 2024/2847 prevails.