Three families of software coexist on every digital device, from smartphones to enterprise servers. Their respective scope determines what the machine can execute, what the user can produce, and what the developer can create. Understanding these categories of computer software also means grasping why the same tool can fall under very different technical and regulatory frameworks depending on how it is distributed.
Comparison of the three categories of computer software
Before analyzing each family in detail, a summary table allows us to visualize the differences in function, target user, and distribution model.
| Criterion | System software | Application software | Development software |
|---|---|---|---|
| Main function | Manage the hardware and resources of the device | Meet a specific user need (writing, management, communication) | Create, test, and maintain other software |
| Common examples | Windows, macOS, Linux, drivers, BIOS/UEFI | Web browser, spreadsheet, management software, video game | Code editor, compiler, debugger, integrated development environment (IDE) |
| Typical user | Everyone (transparent operation) | General public and professionals | Developers, software engineers |
| Direct interaction | Rare (except for configuration) | Daily | Frequent during the design phase |
| Common licensing model | Pre-installed or open source | License, SaaS subscription, free | Open source or commercial license |
This breakdown highlights a often overlooked point: system software operates without the user noticing, while the other two categories require conscious interaction. It is this invisibility that makes system software both fundamental and underestimated.
Asking what computing is for often leads to thinking about visible applications, but the system layer conditions everything else.
System software and operating systems: the invisible layer of the computer
The operating system (OS) forms the core of this first category. Windows, macOS, and Linux distributions manage memory allocation, file management, and communication with peripherals. Without this layer, no application software could launch.
Surrounding the OS are lesser-known but equally crucial components. Drivers translate the generic instructions from the OS into commands understandable by each hardware component: graphics card, printer, biometric sensor. The firmware, stored directly in the hardware (BIOS or UEFI), comes into play even before the OS loads.
Why system software security is changing in Europe
The European Cyber Resilience Act (CRA) imposes security obligations throughout the lifecycle of digital products that have a direct or indirect connection to devices or networks. Reporting obligations for actively exploited vulnerabilities will apply from September 11, 2026. General obligations for managing vulnerabilities and security updates must apply from December 11, 2027.
The CRA also stipulates that manufacturers must consider vulnerabilities in third-party components integrated into their software. An operating system that includes open-source libraries remains responsible for their updates. This traceability requirement changes how publishers design and maintain the system layer.
Application software: everyday tools for business and home
This is the broadest and most diverse category. Application software addresses a specific functional need: writing a document, managing accounts, editing a photo, communicating via videoconference.
- Office applications (word processing, spreadsheets, presentations) remain the backbone of productivity in most businesses. Microsoft Office and its open-source alternatives cover this segment.
- Management software (ERP, CRM, project management) centralizes operational data. Their complexity ranges from a simple tracking tool to an integrated system covering the entire value chain.
- Communication applications (instant messaging, videoconferencing, email) have become the primary professional reflex, with usage far exceeding the office context.
- Multimedia software (players, video editors, graphic creation tools) serves both independent creators and large production teams.
SaaS or installed software: a choice that goes beyond technology
The same application software can fall under different regulatory frameworks depending on its distribution method. SaaS services (accessible via a browser) are generally excluded from the scope of the Cyber Resilience Act, unless remote data processing is deemed necessary for the functioning of a covered product. An installed spreadsheet on a laptop and the same spreadsheet used online are therefore not subject to the same compliance constraints.
This distinction has practical consequences for companies weighing the options between cloud subscription and local license. The total cost of ownership (TCO) is not limited to the license price: it includes maintenance, security updates, and now, regulatory compliance.
Software development tools: the category that creates the other two
Development software is used to design, compile, test, and debug programs. A code editor like Visual Studio Code, a compiler, a version control system (Git), or an integrated development environment (IDE) belong to this family.
This category produces both system and application software, which gives it a structuring role in the entire digital ecosystem. A vulnerability introduced at this stage can potentially propagate into thousands of end applications.
The CRA takes this reality into account by imposing the management of vulnerabilities in integrated third-party components. An IDE that automatically generates code from external libraries holds the publisher responsible for the produced dependency chain.
- Compilers transform human-readable source code into machine-executable instructions.
- Debuggers allow tracing the execution of a program step by step to identify the source of a malfunction.
- Version control systems (Git, Subversion) ensure traceability of each code modification, facilitating collaboration among developers and rollback in case of issues.
The three categories of software do not operate in silos: system software hosts applications, development tools create both, and European regulation is beginning to treat this chain of dependencies as a whole. Identifying the category of software is no longer just a technical classification exercise; it is also a matter of compliance and responsibility.
