Use this CRA FAQ to understand how Annex I Part I and Part II work, what applies to every in-scope product, and how manufacturers must justify, document, and evidence compliance.
Built for product security, engineering, legal, certification, and compliance teams interpreting the CRA's core technical requirements.
Structured answer sets in this page tree.
Cited legal and guidance references.
The CRA's essential cybersecurity requirements are the core compliance baseline for products with digital elements. This FAQ focuses on how Annex I Part I and Part II differ, when requirements apply, how manufacturers justify inapplicability, and what evidence is needed to show conformity at product level.
The CRA splits the essential cybersecurity requirements into two parts:
- Part I of Annex I covers the cybersecurity properties the product itself must have
- Part II of Annex I covers the vulnerability-handling processes the manufacturer must put in place
Article 6, Annex I
Research Copilot can turn EU Cyber Resilience Act FAQ Essential Cybersecurity Requirements into a reusable cited workflow for teams implementing EU Cyber Resilience Act FAQ.
Start from EU Cyber Resilience Act FAQ Essential Cybersecurity Requirements and move to source-backed decisions and evidence workflows.
Review evidence gaps, ownership, and next steps for EU Cyber Resilience Act FAQ.
Yes.
Under Article 6, products may only be made available on the market where the product meets the Part I requirements and the manufacturer's processes comply with the Part II requirements.
Article 6, Article 13(1)
No.
Part I focuses on the product as placed on the market. Part II contains vulnerability-handling obligations that manufacturers must comply with when the product is placed on the market and throughout the support period.
Article 6, Article 13(1), Article 13(7)-(9), Annex I
section 4.1.3
No.
The requirements are objective-oriented and technology-neutral. The CRA does not mandate one specific cybersecurity risk-assessment methodology. Manufacturers can choose their methodology, but it must support identifying, evaluating and treating the relevant risks and documenting how the essential requirements are met.
Article 13(2)-(4), Annex I
section 4.1.2, section 4.2.1
Not in exactly the same way.
For Part II, manufacturers need to comply with all vulnerability-handling requirements. For Part I, Article 13(3) requires the manufacturer to determine through the cybersecurity risk assessment which point (2) requirements are applicable to the product and how they are implemented. If a specific requirement is not applicable, the manufacturer must include a clear justification in the technical documentation.
Article 13(3)-(4), Annex I
section 4.1.3
It is the general product-level requirement to ensure an appropriate level of cybersecurity based on the risks.
The March 2026 draft guidance explains that this point is meant to catch additional cybersecurity risks identified by the risk assessment that are not otherwise adequately addressed by the other specific Part I requirements. In most cases, complying with the other applicable Part I requirements will also satisfy point (1), but if additional relevant risks remain, the manufacturer still has to address them at product level.
Article 13(2)-(3), Annex I Part I, point (1)
points 148-150
No.
The CRA does not require a product to be free from all vulnerabilities. For placement on the market, the relevant product requirement is that, on the basis of the cybersecurity risk assessment and where applicable, the product is made available without known exploitable vulnerabilities. After placement on the market, the manufacturer must address and remediate relevant vulnerabilities without delay in line with Part II of Annex I.
Annex I Part I, point (2)(a), Annex I Part II, point (2)
section 4.2.2, section 4.3.1
No.
The draft guidance says residual cybersecurity risk is assessed against the CRA's regulatory threshold, not against the manufacturer's internal risk tolerance, commercial strategy or cost preferences. If identified risks are not adequately addressed, the product cannot simply be placed on the market anyway.
Article 13(2)-(3), Annex I Part I, point (1)
points 141-147
No.
The CRA requires manufacturers to place a compliant product on the market. Information and instructions can support secure installation, operation, integration and deployment, but the draft guidance says they cannot be used to compensate for product-design shortcomings or to justify leaving incompatible risks untreated.
Article 13(18), Annex II
points 145-147
Part I, point (2) is a structured set of product-security outcomes that the manufacturer must apply where relevant on the basis of the cybersecurity risk assessment.
It covers, among other things:
- no known exploitable vulnerabilities at placement on the market
- secure-by-default configuration
- the ability to address vulnerabilities through security updates
- protection from unauthorised access
- confidentiality and integrity protection
- data minimisation
- protection of essential and basic functions, including after incidents
- attack-surface reduction
- exploitation-mitigation techniques
- security-related logging and monitoring
- secure removal and transfer of data and settings
Annex I Part I
section 4.1.3, section 4.2.1
They apply to the whole product.
The Commission FAQ says the cybersecurity risk assessment must cover the entire product with digital elements, including remote data processing when it is in scope and supporting functions that form part of the product. The draft guidance likewise explains that risks from external services, networks and other dependencies may need to be addressed through product-level measures so that the product as a whole complies.
Article 3(1), Article 13(2)-(5), Annex I
section 4.1.1
points 151-157, 162
The CRA recognises that this can happen, but it is not a free pass.
If a requirement is not applicable because of the nature of the product, the manufacturer must clearly justify that in the technical documentation. Recital 55 and the Commission FAQ give interoperability as an example. If cybersecurity risks still arise in relation to that inapplicable requirement, the manufacturer must address those risks by other appropriate means.
Article 13(4), recital 55
section 4.1.3
No.
Harmonised standards are voluntary and do not replace the manufacturer's own duty to assess risks and demonstrate compliance. They can support conformity, but manufacturers may also use other technical means if they document how the applicable essential requirements are met.
Article 27, Article 31, Annex I
section 4.1.7, section 4.2.1
Annex I sets the substantive cybersecurity outcomes and processes that the product and manufacturer must meet. Annex II requires the manufacturer to give users the information they need to install, operate, update, integrate and decommission the product securely.
That includes, among other things, the intended purpose, security properties, significant cybersecurity-risk circumstances, support-period information, update information, secure decommissioning information, and information needed by downstream integrators.
Article 13(18)-(19), Annex I, Annex II
The CRA does not prescribe one evidence format, but it does require the manufacturer to document how the applicable essential requirements are met.
That means the manufacturer needs to show in the cybersecurity risk assessment and technical documentation:
- which Part I requirements are applicable
- how they are implemented
- how Part I point (1) and Part II are applied
- what technical means, standards, specifications or other solutions are used
- what testing, review or other evidence supports those conclusions
Article 13(3)-(4), Article 31, Annex VII
section 4.1.1, section 4.2.1
No.
The essential cybersecurity requirements in Annex I apply horizontally to all products with digital elements that are in scope. The important or critical classification affects the conformity-assessment route, not whether the Annex I requirements apply in the first place.
Article 6, Article 7, Article 8
section 4.2.1
Yes.
Recital 38 makes clear that the essential cybersecurity requirements, including the vulnerability-handling requirements, apply to each individual product with digital elements when it is placed on the market, whether the product is manufactured as an individual unit or in series. The recital gives a practical example: each individual product placed on the market should already have received all security patches or updates available to address relevant security issues at that time.
recital 38, Article 13(1)
No.
The March 2026 draft guidance says the CRA does not allow the manufacturer to transfer cybersecurity risk or responsibility to users or third parties. Information and instructions can support secure deployment, operation or integration, and can inform users about residual risks, but the obligation to place a secure product on the market and demonstrate conformity with the essential cybersecurity requirements remains with the manufacturer.
points 145-146
Article 13(18), Annex II
No.
The draft guidance says that where identified risks cannot be adequately addressed through appropriate measures, compliance may require changes to the product's design, functionality or intended purpose. Cost or commercial feasibility alone is not a sufficient reason to leave such risks untreated, and warnings cannot justify placing a product on the market where the remaining risks are incompatible with the essential cybersecurity requirements.
point 147
Article 13(2)-(4), Annex I Part I, point (1)
The CRA allows justified constraints, but not an automatic downgrade.
Where a product must interoperate with existing systems that only support an older or less secure approach, the manufacturer may rely on that approach only if it is necessary for interoperability, the associated risks are identified and documented, and other appropriate mitigation measures are implemented. The draft guidance adds that if it is technically feasible to support both the secure and the less secure option, the secure option is expected to be implemented and enabled by default, while the less secure option should be used only where interoperability requires it.
Article 13(4), recital 55
point 29 and Example 6