EU Cyber Resilience Act FAQ Component Due Diligence

The manufacturer must exercise due diligence so that third-party components do not compromise the cybersecurity of the finished product.

This obligation sits inside Article 13 and supports the manufacturer's broader duty to ensure that the product is designed, developed and produced in accordance with the CRA's essential cybersecurity requirements.

No.

The CRA expressly says the obligation also covers free and open-source software components that were not made available on the market in the course of a commercial activity. The Commission's FAQ also confirms that manufacturers may integrate components that are outside the CRA, pre-date CRA application, or have not been placed on the market, but they still have to ensure those components do not compromise the finished product.

No.

The CRA materials make this a risk-based obligation. The appropriate level of due diligence depends on the nature and level of cybersecurity risk associated with the component, and the product's cybersecurity risk assessment also informs how much checking is appropriate.

The CRA materials give a non-exhaustive set of examples. Depending on the component and the level of risk, due diligence can include:

- checking whether the component already bears the CE marking

- checking whether the component manufacturer has demonstrated conformity with the CRA

- verifying that the component receives regular security updates, for example by checking its update history

- checking the European vulnerability database or other publicly accessible vulnerability databases for applicable vulnerabilities

- carrying out additional security testing

- performing software composition analysis

- reviewing the component's SBOM when available

- checking the component's support period

- verifying that the component's intended purpose fits the integrating manufacturer's use

- assessing the security posture of the component manufacturer

The Commission's FAQ gives examples such as fuzz testing, penetration testing, firmware analysis, side-channel analysis, red-team exercises, network traffic analysis, and sensor spoofing.

Those are examples, not a mandatory checklist. The right testing depth still depends on the component's role and risk.

No.

The CRA does not require manufacturers to integrate only CE-marked components. Components that were not placed on the market, were placed on the market before the CRA applies, or fall outside the CRA can still be integrated, provided the integrating manufacturer exercises due diligence so they do not compromise the finished product.

Yes, but only as supporting evidence.

The Commission's FAQ says that when integrating components that bear the CE marking, manufacturers may rely on the component's EU declaration of conformity and accompanying documentation to support their own compliance. That still does not remove the integrating manufacturer's own obligation to make sure the component is suitable for the finished product and does not compromise its cybersecurity.

The CRA anticipated that situation.

Recital 35 says that immediately after the transition period a manufacturer may not yet be able to verify, for example by checking CE marking, that a previously integrated component's manufacturer has demonstrated conformity with the CRA. In that case, the manufacturer should exercise due diligence through other means.

They are distinct but complementary obligations.

The draft Commission guidance explains that the cybersecurity risk assessment under Article 13(2) covers the risks affecting the product as a whole, including external dependencies and operating context. Due diligence under Article 13(5) focuses more specifically on third-party components that form part of the product and on verifying, in a risk-based way, that those components match the product's cybersecurity needs.

The draft Commission guidance says evidence may consist of documentation obtained from the component manufacturer, such as technical specifications, security documentation, or relevant conformity or assurance documentation. Where appropriate, the manufacturer may also carry out functional tests on the component.

The CRA also requires manufacturers to systematically document relevant cybersecurity aspects and to keep technical documentation showing conformity, so this material will normally form part of the broader compliance record for the product.

No.

The CRA encourages identification and documentation of components, including by drawing up an SBOM, and the Commission's FAQ lists review of a component SBOM, when available, as one possible due-diligence step. But the CRA recital also says manufacturers should not be obliged to make the SBOM public.

The manufacturer must report the vulnerability to the person or entity manufacturing or maintaining the component and must address and remediate it in line with the CRA's vulnerability-handling requirements.

The draft guidance adds two important limits: the upstream-reporting obligation concerns the version of the component that the manufacturer actually integrates, and it covers vulnerabilities that exist in the integrated component itself, not vulnerabilities caused only by the manufacturer's own integration choices. If the manufacturer develops a software or hardware modification to address the vulnerability in that component, it must share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format.

Often yes, but not completely.

Where the component itself was placed on the market after the CRA applies, the integrating manufacturer can benefit from the component manufacturer's own vulnerability-handling obligations. But the integrating manufacturer still remains responsible for the finished product and must continue to meet its own vulnerability-handling duties for that product as a whole.

No, not by itself.

The draft guidance says that manufacturers integrating FOSS components do not become responsible for those components' individual CRA compliance merely because they contribute source code to their maintenance. The status of that FOSS component depends on whether the entity that publishes it places it on the market. The integrating manufacturer still remains responsible for its own product and must still perform due diligence on the FOSS component it uses.

The same due-diligence obligation still applies.

Manufacturers may integrate open-source components that are outside the CRA because they were not made available on the market in the course of a commercial activity, but they still have to apply risk-based due diligence. The CRA also empowers the Commission to establish voluntary security attestation programmes that could help manufacturers assess such open-source components.

The draft guidance says those solutions should be treated like third-party components.

Where the solution is necessary for the product to perform one of its functions but is not designed and developed by the manufacturer or under its responsibility, the manufacturer should assess the integration risks in the cybersecurity risk assessment, mitigate them through product-level measures, and exercise due diligence on that third-party solution. The guidance gives this logic for examples such as third-party SaaS support chat, PaaS notification environments and SaaS storage services.

No.

The draft guidance distinguishes between integrated third-party components and mere communication or connectivity enablers. For example, a cellular network that a smartphone uses for connectivity is not treated like a third-party component, because there is no software integrated into the product from that network provider. In that scenario, the guidance says it is not necessary to exercise due diligence obligations toward the network provider.

Not necessarily.

The draft guidance says manufacturers are not required to report upstream where the component no longer has a maintainer. It also says upstream reporting is not required where the manufacturer has duplicated a FOSS component and no longer relies on the original maintainer for new versions or security fixes.

No.

The draft guidance says the CRA requires the manufacturer to share the fix, where appropriate, but not to ensure that the maintainer accepts it or integrates it into the component's codebase. It also does not require the manufacturer to accept a fix proposed by the maintainer if the manufacturer prefers another suitable mitigation.

Yes.

The Commission's FAQ expressly lists the support period of a component as one of the due-diligence checks manufacturers may undertake, and Article 13(8) allows manufacturers to take into account the support periods of third-party integrated components that provide core functions when determining the support period for their own product.

No.

The CRA sets a due-diligence obligation aimed at ensuring that integrated components do not compromise the finished product's cybersecurity. The Commission's FAQ and draft guidance both describe a risk-based process of verification, testing, mitigation and remediation, not a requirement to prove that every component is free of all flaws in every context.