--- title: "CRA Blue Guide Concepts FAQ" canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts" source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts" author: "Sorena AI" description: "CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions." published_at: "2026-03-10" updated_at: "2026-03-10" keywords: - "CRA Blue Guide FAQ" - "CRA placing on the market" - "CRA making available" - "CRA CE marking" - "CRA manufacturer importer distributor" - "CRA distance sales" - "Cyber Resilience Act" - "CRA FAQ" - "EU compliance" - "CRA Blue Guide Concepts FAQ" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CRA Blue Guide Concepts FAQ CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions. *FAQ* *EU* *Cyber Resilience Act* ## EU Cyber Resilience Act FAQ Blue Guide Concepts Understand the product-law concepts that drive CRA timing and supply-chain responsibility, including placing on the market, making available, imports, CE marking, manufacturer/importer/distributor roles, online sales, transition stock, and unfinished software testing. Built for legal, compliance, product, supply-chain, and go-to-market teams that need defensible CRA launch and distribution decisions. This FAQ explains how Blue Guide product-law concepts apply to the Cyber Resilience Act. It focuses on when a product with digital elements is placed on the Union market, when later supplies are only making available, which economic operator role is triggered, what CE marking means, and where the CRA has specific limits for software testing, stock, imports, updates, and transition products. ## Why does the Blue Guide matter for CRA interpretation? Because the CRA sits within the New Legislative Framework product-law architecture and uses the same core concepts that the Blue Guide explains, including placing on the market, making available on the market, CE marking, technical documentation, declarations of conformity, notified bodies, and market surveillance. The Commission's CRA FAQ repeatedly relies on the Blue Guide when explaining those concepts, and the draft Commission guidance expressly describes the CRA as being built on the NLF. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on why CRA interpretation uses Blue Guide and NLF product-law concepts; sections 1.2, 2.2 to 2.8, 4.3, 4.4 and 7. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on why CRA interpretation uses Blue Guide and NLF product-law concepts; sections 1.4, 4.1.7, 4.1.8, 6.6, 6.8 and 7.2. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on why CRA interpretation uses Blue Guide and NLF product-law concepts; introduction and section 2.1. ## What is "placing on the market" for CRA Blue Guide purposes? It is the first making available of an individual product on the Union market. That is the decisive timing point for CRA compliance, because the applicable requirements are assessed when the individual product is first placed on the market. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on the CRA placing-on-the-market definition and its compliance timing effect; section 2.3. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on the CRA placing-on-the-market definition and its compliance timing effect; Article 3(21), Article 6 and Article 13. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on the CRA placing-on-the-market definition and its compliance timing effect; sections 1.4 and 7.2. ## Under the CRA, what must already be complete when a product is placed on the market? The required compliance work must already be complete at that point. The Blue Guide says that, by the time of placing on the market, the manufacturer must have completed the design work against the applicable requirements, the relevant risk and conformity assessment, the declaration of conformity, the marking steps and the technical file. The CRA aligns with that logic by requiring the technical documentation to be drawn up before placement on the market and the cybersecurity risk assessment to be included in it. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on the conformity, documentation, declaration and CE-marking work that must be complete by placement; section 2.3, including footnote 55. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on the conformity, documentation, declaration and CE-marking work that must be complete by placement; Article 13(4), Article 13(12), Article 28, Article 30 and Article 31. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on the conformity, documentation, declaration and CE-marking work that must be complete by placement; sections 6.6, 6.7 and 6.8. ## How do manufacturer, importer and distributor roles connect to CRA market-placement concepts? The role follows the supply-chain function, not the job title on an org chart. Under the CRA, the manufacturer is the actor that develops, manufactures, or has the product designed, developed or manufactured and markets it under its own name or trademark. The importer is the EU-established actor that places on the market a product bearing the name or trademark of a person established outside the Union. The distributor is the supply-chain actor, other than the manufacturer or importer, that makes the product available on the Union market without affecting its properties. That distinction matters because the first EU supply is usually the placing-on-the-market event handled by the manufacturer or importer, while later reseller handoffs are usually making-available events handled by distributors. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(13), Article 3(16), Article 3(17), Article 3(21) and Article 3(22) define the CRA operator roles and market-placement concepts used in this answer. - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Sections 2.2, 2.3 and 3 explain that making available and placing on the market apply to individual products and connect to supply-chain roles. ## What CRA checks should an importer complete before placing a product with digital elements on the Union market? The importer is not merely a logistics label under the CRA. Before placing the product on the market, the importer must ensure that the manufacturer has carried out the appropriate conformity assessment, drawn up the technical documentation, applied the CE marking, supplied the EU declaration of conformity and user information, and met the manufacturer identification and support-period information requirements referenced in Article 19. If the importer considers or has reason to believe the product or the manufacturer processes are not in conformity, it must not place the product on the market until conformity is restored; if there is a significant cybersecurity risk, it must inform the manufacturer and market surveillance authorities. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 19(1)-(3) sets the importer compliance checks and stop-sale duty before placing a CRA product on the Union market. - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 2.5 and Annex 5 explain the importer role for products from outside the EU and the need to verify documentation and CE marking. ## What CRA checks should a distributor complete before making a product available? A distributor has a due-care role even though it normally does not perform the manufacturer conformity assessment. Before making a product with digital elements available, the distributor must verify that the product bears the CE marking and that the manufacturer and importer have provided the required documents and operator information referenced by Article 20. If the distributor has reason to believe the product or manufacturer processes are not in conformity, it must not make the product available until conformity is restored. If the product poses a significant cybersecurity risk, it must inform the manufacturer and market surveillance authorities without undue delay. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 20(1)-(4) sets distributor due-care, CE-marking verification, document-check, stop-sale and notification duties. - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Annex 5 explains that distributors help ensure only compliant CE-marked products circulate and must assist authorities with documentation. ## When does an importer or distributor become the CRA manufacturer? When it changes the legal role, not merely because it resells the product. The CRA treats an importer or distributor as the manufacturer if it places a product with digital elements on the market under its own name or trademark, or if it carries out a substantial modification of a product already placed on the market. In that situation, the actor becomes subject to the manufacturer obligations in Articles 13 and 14. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 21 explains when importer or distributor conduct triggers CRA manufacturer obligations. - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 1.2 and Annex 5 describe the NLF rule that importers or distributors taking over branding or modification responsibilities assume manufacturer-like obligations. ## What does CE marking mean for a CRA product with digital elements? It is the manufacturer-facing conformity signal for the CRA and other applicable Union harmonisation legislation, not a cybersecurity rating or a mark of EU origin. The CRA defines CE marking as the mark by which the manufacturer indicates that the product with digital elements and the manufacturer processes conform to the CRA essential cybersecurity requirements and to other applicable Union harmonisation legislation that provides for CE marking. The Blue Guide adds that CE marking is affixed after the relevant conformity assessment and declaration work, and that it is not a mark showing where the product was made. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(31), Article 29 and Article 30 define CE marking and the CRA rules for affixing it. - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Sections 4.5.1 and Annex 5 explain the meaning of CE marking, including that it is not a mark of origin. ## What is "making available on the market" under CRA Blue Guide concepts? It is the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge. Once a product has already been placed on the market, later supplies in the distribution chain are usually cases of making available, not new placing-on-the-market events. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on the CRA making-available definition and later distribution-chain supplies; sections 2.2 and 2.3. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on the CRA making-available definition and later distribution-chain supplies; Article 3(22). ## Under CRA Blue Guide concepts, does placing on the market happen once per model or once per individual unit? Once per individual product. The Blue Guide explains that placing on the market refers to each individual product, not to a model or type. That is why units of an existing model first placed on the market after new requirements apply must comply with the new rules. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on placing on the market applying to each individual product rather than a model type; section 2.3. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on placing on the market applying to each individual product rather than a model type; section 7.2. ## Under CRA Blue Guide concepts, does placing on the market require payment? No. The Blue Guide explains that the first supply can be for payment or free of charge. What matters is that the product is complete and supplied for distribution, consumption or use on the Union market. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on free-of-charge supply still being capable of making a product available or placing it on the market; section 2.3. ## Under CRA Blue Guide concepts, does placing on the market require physical handover of the product? No. The Blue Guide says placing on the market requires a completed product and an offer or agreement transferring ownership, possession or another property right, but it does not require physical handover. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on physical handover not being required when the transfer agreement has occurred after manufacture; section 2.3. ## Under CRA Blue Guide concepts, does stock in a manufacturer's or importer's warehouse count as placing on the market? No, not by itself. Products kept in the stock of the manufacturer, the authorised representative or the importer are not yet placed on the market if they have not yet been supplied for distribution, consumption or use. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on manufacturer or importer warehouse stock not being placed on the market until supplied; section 2.3. ## Under CRA Blue Guide concepts, can an internal transfer within the manufacturer's own distribution structure count as placing on the market? Yes. The first supply for distribution on the Union market can still be a placing-on-the-market event even if it happens through the manufacturer's own commercial chain rather than through an unrelated distributor. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on first supply through the manufacturer commercial chain still being capable of placing the product on the market; section 2.3. ## Under CRA Blue Guide concepts, which first supply transaction matters for placing on the market? The first one. For the individual product, the legal placing-on-the-market event is the first supply for distribution, consumption or use on the Union market, whether that first supply is to an importer, a distributor or directly to the end user. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on the first supply to an importer, distributor or end user being the relevant placement event; section 2.3. ## Under CRA Blue Guide concepts, does a pre-order before manufacture is complete count as placing on the market? No. The Blue Guide explains that placing on the market requires the manufacturing stage to be complete. An offer or agreement concluded before the product is finished is not yet placing on the market. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on pre-orders before completion of manufacture not yet placing a product on the market; section 2.3. ## How do distance sales and online sales affect CRA Blue Guide timing? They can bring a product into EU product-law scope before physical delivery to the customer. If an online or distance offer is targeted at Union end users, the product is deemed to be made available on the Union market for market-surveillance purposes. The Blue Guide says that whether an offer targets Union end users must be assessed case by case, taking into account factors such as dispatch areas, ordering languages and payment possibilities; mere website accessibility is not enough. Where the product is already manufactured and ready to be shipped, a direct distance sale to an EU end user can also be the placing-on-the-market event for that individual product. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on targeted online offers, market-surveillance treatment and distance-sale placement timing; section 2.4 and example 5 in section 2.12. ## Under CRA Blue Guide concepts, does an online offer targeting EU customers mean the product is already placed on the market? Not necessarily. The Blue Guide distinguishes between products being deemed made available on the Union market for market-surveillance purposes and the actual placing-on-the-market event for the individual product. The latter still depends on the distribution chain and on whether the product is already manufactured and supplied for distribution or use. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on targeted online offers being deemed made available without always being the first placing-on-the-market event; section 2.4. ## Under CRA Blue Guide concepts, when do imported products count as placed on the Union market? Often at release for free circulation, but not always. The Blue Guide says products declared for release for free circulation can generally be treated as placed on the market, while also making clear that in practice placing on the market may happen before or after that customs step depending on the distribution chain. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on import release for free circulation and distribution-chain facts affecting placement timing; section 2.5 and examples 2 and 7 in section 2.12. ## Under CRA Blue Guide concepts, are products in transit, free zones or temporary storage already placed on the market? No. The Blue Guide says placing on the market is considered not to take place where products are introduced into the EU customs territory in transit, placed in free zones, temporary storage, warehouses or other special customs procedures. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on transit, free-zone and temporary-storage situations not normally being placing-on-the-market events; sections 2.3 and 2.5. ## Under CRA Blue Guide concepts, is a personal import after an in-person third-country purchase placing on the market? No. The Blue Guide treats that situation as outside placing on the market. It also distinguishes it from products bought online and shipped into the EU, which do not fall under that carve-out. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on personal third-country purchases carried into the EU being outside placing on the market; section 2.3, including footnote 50. ## Does manufacturing for one's own use count as placing on the market under the CRA? Usually no. The Blue Guide says placing on the market does not occur where a product is manufactured for one's own use unless the legislation in question expressly treats own use as an equivalent trigger. The Commission's CRA FAQ applies that logic to the CRA and explains that products developed only for the manufacturer's own use are outside scope unless they are separately placed on the market. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on own-use manufacturing and the CRA scope treatment for products developed only for internal use; section 2.3. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on own-use manufacturing and the CRA scope treatment for products developed only for internal use; section 1.5. ## What is "putting into service," and does it usually matter under CRA Blue Guide concepts? The Blue Guide defines it as the first use of a product within the Union by the end user for its intended purpose. That concept matters in some Union product laws, but the CRA's general trigger structure is built around placing on the market and making available on the market, not a separate general putting-into-service trigger. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on putting into service and why CRA generally uses placing-on-the-market and making-available triggers instead; section 2.6. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on putting into service and why CRA generally uses placing-on-the-market and making-available triggers instead; Article 3(21), Article 3(22), Article 6 and Article 13. ## Under CRA Blue Guide transition concepts, can a product lawfully placed on the market before new rules still be sold later? Yes, in principle. The Blue Guide explains that once a compliant product has been placed on the market, it may continue to be made available later in the distribution chain even if the law changes afterward or the relevant harmonised standards are revised, unless the new legislation provides otherwise. The Commission's CRA FAQ applies the same logic to the CRA transition. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on lawfully placed products continuing through later distribution unless the new law provides otherwise; sections 2.3, 2.10 and 4.1.2.5. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on lawfully placed products continuing through later distribution unless the new law provides otherwise; sections 1.4 and 7.2. ## Under CRA Blue Guide transition concepts, can lawfully placed stock stay in a distributor warehouse and still be sold later? Yes. The relevant question is whether the individual product had already been placed on the market before the new rules applied. If it had, later storage and resale within the distribution chain do not create a new placing-on-the-market event. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on already placed distributor stock being later made available without a new placement event; sections 2.3 and 2.10. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on already placed distributor stock being later made available without a new placement event; section 7.2. ## Under CRA Blue Guide concepts, does repeated renting create a new placing-on-the-market event? No. The Blue Guide says repeated renting of the same product does not create a new placing-on-the-market event. The compliance moment remains the first renting or other first supply of that individual product. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on repeated renting of the same product not creating a new placing-on-the-market event; section 2.3. ## Under CRA Blue Guide concepts, are prototypes or pre-production units at trade fairs already placed on the market? No, provided the Blue Guide and CRA conditions are met. The Blue Guide treats products displayed or operated under controlled conditions at trade fairs, exhibitions or demonstrations as not yet placed on the market, as long as they are clearly identified as non-compliant and not yet available for placing on the market. The CRA contains the same type of carve-out for products, including prototypes, presented or used at such events. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on trade-fair and demonstration prototypes not being placed on the market when marked and controlled as non-compliant; section 2.3. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on trade-fair and demonstration prototypes not being placed on the market when marked and controlled as non-compliant; Article 4(2) and recital 36. ## Under the CRA, can unfinished software be made available for testing before full compliance? Yes, but only under a narrow CRA exception. Article 4(3) allows unfinished software such as alpha versions, beta versions or release candidates to be made available on the market for the limited period required for testing, provided it carries a visible sign stating that it does not comply and is not available for purposes other than testing. Recital 37 also says manufacturers should not force users to upgrade to versions released only for testing purposes. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on the CRA unfinished-software testing exception for alpha, beta and release-candidate software; Article 4(3) and recital 37. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on the CRA unfinished-software testing exception for alpha, beta and release-candidate software; section 2.3, including footnote 7. ## Why does the Blue Guide matter for technical documentation and declarations of conformity under the CRA? Because the CRA uses the same NLF documentation logic. The Blue Guide explains the role of technical documentation and the possibility of a single declaration of conformity dossier across several Union acts. The Commission's CRA FAQ relies on that same logic when explaining what technical documentation must contain and how the declaration of conformity works under the CRA. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on technical documentation and EU declaration of conformity logic under CRA and the Blue Guide; sections 4.3 and 4.4. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on technical documentation and EU declaration of conformity logic under CRA and the Blue Guide; Article 28(3), Article 31 and Annex VII. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on technical documentation and EU declaration of conformity logic under CRA and the Blue Guide; sections 4.1.8, 6.6 and 6.8. ## Why does the Blue Guide matter for intended purpose and reasonably foreseeable use under the CRA? Because the CRA uses the same product-law logic that compliance cannot be assessed only against the manufacturer's preferred use case. The Commission's CRA FAQ relies on Blue Guide Concepts to explain that the cybersecurity risk assessment must take account of intended purpose, reasonably foreseeable use and reasonably foreseeable misuse, and that those choices also affect the user information that has to be provided. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on intended purpose, reasonably foreseeable use and misuse in CRA risk assessment and user information; sections 2.8 and 3.1. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on intended purpose, reasonably foreseeable use and misuse in CRA risk assessment and user information; sections 4.1.4, 4.1.5, 4.1.7 and 4.1.8. ## How are CRA Blue Guide market-placement concepts applied to standalone software supplied digitally? For software, the CRA follows the same NLF concepts, but the draft Commission guidance explains how they work in a digital delivery model. According to the draft guidance, once the software manufacturing phase is complete and a given software product is first offered for distribution or use on the Union market in the course of a commercial activity, that software product is regarded as placed on the market. Later downloads or remote access to that same unchanged software product are instances of making available rather than fresh placing-on-the-market events. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on draft CRA guidance on digital supply of standalone software and the first offering as placement; Article 3(21) and Article 3(22). - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on draft CRA guidance on digital supply of standalone software and the first offering as placement; section 2.1, points 10 to 14. ## Under CRA Blue Guide concepts, does a later non-substantial software version get a new placing-on-the-market date? No. The draft guidance says later iterations that do not qualify as substantial modifications do not trigger a new conformity assessment and do not change the software product's date of placement on the market. A new placing-on-the-market date arises only where the later iteration qualifies as a substantial modification. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on draft CRA guidance on non-substantial software iterations not creating a new placement date; Article 3(30) and recital 41. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on draft CRA guidance on non-substantial software iterations not creating a new placement date; section 2.1, points 15 and 16. ## Under CRA Blue Guide concepts, does the same software-placement rule apply to physical media or hardware bundles? No. The draft guidance says the "first offering creates the placing-on-the-market date" logic applies only to standalone software supplied via digital means. If the software is supplied on a USB flash drive or other physical medium, the physical item is the product supplied for distribution. If software is necessary for hardware to perform its intended functions, the hardware and that software together form the product placed on the market. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on draft CRA guidance distinguishing standalone digital software from physical media and hardware bundles; Article 3(1). - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on draft CRA guidance distinguishing standalone digital software from physical media and hardware bundles; section 2.1, point 16, and section 2.2, points 17 to 19. ## Primary sources - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the market-access concepts used throughout the FAQ: making available, placing on the market, imports, online sales, putting into service, CE marking, declarations of conformity, economic-operator roles and transition stock. - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports CRA-specific application of Blue Guide concepts, including transition products, technical documentation, declarations of conformity and intended-use risk assessment. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports draft CRA guidance points on digital software placement, substantial modifications and the CRA relationship with NLF concepts; cited as draft guidance, not final law. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Primary legal source for CRA definitions, manufacturer/importer/distributor duties, CE marking, technical documentation, testing exceptions and transition provisions. ## Topic Guides - [CRA Applicability Test for Products With Digital Elements](/artifacts/eu/cyber-resilience-act/applicability-test.md): Check whether the EU Cyber Resilience Act applies to a hardware, software, firmware, open-source, or connected product before conformity planning. - [CRA Article 14 Reporting Obligations for Vulnerabilities and Incidents](/artifacts/eu/cyber-resilience-act/reporting-obligations.md): Article 14 guide to CRA reports for actively exploited vulnerabilities and severe product-security incidents, including deadlines, CSIRT routing, users, and evidence. - [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md): Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence. - [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md): Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records. - [CRA Conformity Assessment and CE Marking](/artifacts/eu/cyber-resilience-act/conformity-assessment-and-ce-marking.md): How to choose a Cyber Resilience Act conformity route, prepare technical documentation, issue the EU declaration of conformity, and affix CE marking. - [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md): Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route. - [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md): CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence. - [CRA deadlines and compliance calendar | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/deadlines-and-compliance-calendar.md): Track the Cyber Resilience Act entry into force, staged application dates, Article 14 reporting deadlines, transitional rules, and review dates. - [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md): FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties. - [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md): CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls. - [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md): CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information. - [CRA Essential Cybersecurity Requirements in Annex I](/artifacts/eu/cyber-resilience-act/essential-cybersecurity-requirements.md): An official source guide to the Cyber Resilience Act Annex I requirements for product security, vulnerability handling, secure-by-design controls, documentation, and evidence. - [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md): FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes. - [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md): Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence. - [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md): FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences. - [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md): Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility. - [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md): Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates. - [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md): FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence. - [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md): Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records. - [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md): FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls. - [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md): Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties. - [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md): CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes. - [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md): CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records. - [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md): Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work. - [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md): Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations. - [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md): Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths. - [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md): FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs. - [CRA Penalties and Fines: Article 64 Caps and Enforcement Context](/artifacts/eu/cyber-resilience-act/penalties-and-fines.md): Article 64 of the EU Cyber Resilience Act sets administrative fine ceilings for Annex I, manufacturer, reporting, economic-operator, notified-body, and information-request breaches. - [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md): CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment. - [CRA Products with Digital Elements Scope | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/products-with-digital-elements-scope.md): Apply the EU Cyber Resilience Act scope test for software, hardware, remote data processing, components, open-source software, exclusions, and economic-operator roles. - [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md): EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries. - [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md): FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information. - [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md): Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence. - [CRA Requirements | Annex I, Manufacturer Duties and CE Evidence](/artifacts/eu/cyber-resilience-act/requirements.md): Map Cyber Resilience Act requirements from Annex I to manufacturer duties, vulnerability handling, user information, technical documentation, declaration of conformity, and CE marking evidence. - [CRA SBOM and Vulnerability Management Template](/artifacts/eu/cyber-resilience-act/sbom-and-vulnerability-management-template.md): Build a CRA-ready SBOM and vulnerability handling record with component inventory, triage, remediation, disclosure, reporting, update, and technical documentation fields. - [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md): Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products. - [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md): Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review. - [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md): Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties. - [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md): Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence. - [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md): FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document. - [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md): CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access. - [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md): CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions. - [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md): FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits. - [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md): Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information. - [CRA vs RED Cybersecurity Delegated Act](/artifacts/eu/cyber-resilience-act/cra-vs-red-cybersecurity-delegated-act.md): Compare the EU Cyber Resilience Act with the RED cybersecurity delegated act for connected and radio equipment, including scope, timing, evidence, and transition treatment. - [CRA vs UK PSTI Act | Cyber Resilience Act Comparison](/artifacts/eu/cyber-resilience-act/cra-vs-uk-psti-act.md): Compare cited EU Cyber Resilience Act duties with UK PSTI planning points, with UK legal details clearly marked for separate source review. - [CRA Vulnerability Handling and Disclosure | Article 14 Reporting and Security Updates](/artifacts/eu/cyber-resilience-act/vulnerability-handling-and-disclosure.md): How EU Cyber Resilience Act manufacturers should run vulnerability intake, remediation, coordinated disclosure, Article 14 reporting, secure updates, and evidence records. - [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md): Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices. - [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md): FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires. - [EU CRA Compliance Program for Manufacturers and Economic Operators](/artifacts/eu/cyber-resilience-act/compliance.md): Build a Cyber Resilience Act compliance program around product scope, Annex I security requirements, conformity assessment, technical documentation, vulnerability reporting, and market surveillance. - [EU Cyber Resilience Act Checklist for Product Security and CE Marking](/artifacts/eu/cyber-resilience-act/checklist.md): A CRA checklist for products with digital elements: scope, Annex I security controls, vulnerability handling, Article 14 reporting, technical documentation, conformity assessment, CE marking, and support-period evidence. - [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md): CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification. - [EU Cyber Resilience Act FAQ](/artifacts/eu/cyber-resilience-act/faq.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. - [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md): CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes. - [EU Cyber Resilience Act Technical Documentation and Audit File](/artifacts/eu/cyber-resilience-act/technical-documentation-and-audit-file.md): Build an audit-ready CRA technical file around Article 31 and Annex VII: product scope, risk assessment, vulnerability handling, conformity evidence, testing, and retention. *Recommended next step* *Placement: after the FAQ section* ## Use CRA Blue Guide concepts as a launch and distribution checklist Research Copilot can turn these market-placement, CE marking, and operator-role questions into a cited review for CRA launch, import, reseller, and software-release decisions. - [Open Research Copilot](/solutions/research-copilot.md): Start from the CRA Blue Guide questions that affect launch timing, import checks, CE marking evidence, and distributor handoffs. - [Talk through implementation](/contact.md): Review placement facts, operator roles, missing evidence, and CRA-specific exceptions before release or resale. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts