https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
You should concentrate on understanding what a "product" is under the CRA. If what you've got is a "product" and anything of value is changing hands, you are almost certainly subject to the law. How the value changes hands makes no difference.
