---
title: "EU Cyber Resilience Act FAQ"
canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq"
source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/10"
author: "Sorena AI"
description: "Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance."
published_at: "2026-03-10"
updated_at: "2026-03-10"
keywords:
  - "Cyber Resilience Act FAQ"
  - "CRA scope"
  - "CRA essential cybersecurity requirements"
  - "CRA vulnerability reporting"
  - "CRA CE marking"
  - "Cyber Resilience Act"
  - "CRA FAQ"
  - "products with digital elements"
  - "CE marking"
  - "vulnerability reporting"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# EU Cyber Resilience Act FAQ

Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance.

*FAQ* *EU* *Cyber Resilience Act*

## EU Cyber Resilience Act FAQ

Straight answers to the CRA questions that decide whether a product can be placed on the EU market and what evidence must exist before launch.

This page helps orient product, engineering, security, compliance, legal, importer, distributor, and market-access reviews.

The EU Cyber Resilience Act applies horizontal cybersecurity rules to products with digital elements. This FAQ summarizes the core market-access questions: what is in scope, who carries each role, what manufacturers must build and document, when vulnerability reports are triggered, how conformity assessment and CE marking work, how long support must last, and what market surveillance authorities can check.

## Browse sub-FAQ modules

### [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)

CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions.

- 33 items

### [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)

Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence.

- 15 items

### [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)

Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records.

- 14 items

### [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)

Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route.

- 25 items

### [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md)

CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence.

- 5 items

### [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md)

FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties.

- 16 items

### [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md)

CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls.

- 27 items

### [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md)

CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information.

- 20 items

### [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md)

FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes.

- 14 items

### [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)

Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence.

- 21 items

### [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)

FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences.

- 13 items

### [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md)

Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility.

- 22 items

### [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md)

Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates.

- 12 items

### [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md)

FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence.

- 14 items

### [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md)

Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records.

- 22 items

### [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md)

FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls.

- 17 items

### [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md)

Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties.

- 39 items

### [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md)

CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes.

- 32 items

### [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md)

CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records.

- 31 items

### [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md)

Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work.

- 23 items

### [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md)

Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations.

- 40 items

### [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md)

Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths.

- 26 items

### [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md)

FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs.

- 17 items

### [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md)

CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment.

- 16 items

### [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)

EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries.

- 35 items

### [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)

FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information.

- 16 items

### [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)

Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence.

- 21 items

### [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md)

Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products.

- 17 items

### [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md)

Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review.

- 24 items

### [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md)

Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties.

- 20 items

### [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md)

Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence.

- 16 items

### [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md)

FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document.

- 13 items

### [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md)

CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access.

- 19 items

### [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md)

CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions.

- 23 items

### [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md)

FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits.

- 25 items

### [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md)

Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information.

- 17 items

### [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md)

Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices.

- 17 items

### [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md)

FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires.

- 16 items

### [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md)

CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification.

- 16 items

### [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)

CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes.

- 17 items

Browse all indexed questions: [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md)

## All FAQ items

*Page 10 of 42. Showing 20 of 826 items.*

### [Do CRA common specifications stay in place once a relevant harmonised standard is published?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#do-cra-common-specifications-stay-in-place-once-a-relevant-harmonised-standard-is-published)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

Not for the overlapping essential cybersecurity requirements.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(6) requires repeal of overlapping common specifications after OJ publication of the relevant harmonised standard reference.

### [Can a manufacturer rely on non-harmonised standards or its own technical specifications instead?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#can-a-manufacturer-rely-on-non-harmonised-standards-or-its-own-technical-specifications-instead)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

Yes, but that route does not carry the same presumption.

Sources for this answer:

- [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide section 4.1.3 lists other possibilities and explains the additional demonstration burden.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 requires a list of other relevant technical specifications when harmonised standards or common specifications are not applied.

### [How do European cybersecurity certification schemes interact with CRA presumption of conformity?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#how-do-european-cybersecurity-certification-schemes-interact-with-cra-presumption-of-conformity)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

They can create presumption of conformity only for the CRA requirements covered by the certificate or EU statement of conformity.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(8)-(9) defines certification-scheme presumption and the assurance-level effect for corresponding third-party CRA assessment duties.

### [Does any EU cybersecurity certificate automatically replace CRA conformity assessment?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#does-any-eu-cybersecurity-certificate-automatically-replace-cra-conformity-assessment)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

No. The certificate must be under a relevant European cybersecurity certification scheme, must cover the corresponding CRA requirements, and Article 27(9) requires the Commission to specify which schemes can be used to demonstrate CRA conformity.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 still requires technical documentation to identify applied certification schemes and parts applied.

### [Can important or critical CRA products be compliant without harmonised standards?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#can-important-or-critical-cra-products-be-compliant-without-harmonised-standards)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

Yes, because harmonised standards are voluntary. But for important and critical products, route selection may change.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32(2)-(4) sets conformity assessment routes for class I, class II, and critical products.
- [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 7.4 confirms harmonised standards are a means to demonstrate compliance, not the only means.

### [Can a manufacturer integrate important or critical components that were not designed using harmonised standards?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#can-a-manufacturer-integrate-important-or-critical-components-that-were-not-designed-using-harmonised-standards)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

Yes. The Commission FAQ says manufacturers may integrate important or critical components that were not designed in accordance with harmonised standards, whether or not such standards are available.

Sources for this answer:

- [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 7.4 directly answers whether important or critical components may be integrated without harmonised standards.

### [What must CRA technical documentation say about harmonised standards, common specifications, and certification schemes?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#what-must-cra-technical-documentation-say-about-harmonised-standards-common-specifications-and-certification-schemes)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

It must identify the conformity tools applied in full or in part, and it must identify the gaps.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 31 requires technical documentation to contain the means used to ensure CRA conformity and to be kept updated where appropriate.

### [What happens if CRA standards, common specifications, or certification schemes change after series production starts?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#what-happens-if-cra-standards-common-specifications-or-certification-schemes-change-after-series-production-starts)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

The manufacturer must take those changes into account for continuing conformity.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(14) requires manufacturers to account for changes to standards, common specifications, or certification schemes used for conformity.
- [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide section 4.1.2.5 explains withdrawal dates and coexistence periods for revised harmonised standards.

### [Can OJ-published CRA harmonised standards be restricted, withdrawn, or challenged?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#can-oj-published-cra-harmonised-standards-be-restricted-withdrawn-or-challenged)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

Yes. OJ publication creates the legal effect, but that legal effect can be restricted, prevented, or withdrawn.

Sources for this answer:

- [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide sections 4.1.2.4 and 4.1.2.5 explain restriction, withdrawal, and revision of harmonised-standard references.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Articles 54(6)(b) and 55(3)-(5) address non-compliance attributed to shortcomings in standards, schemes, or common specifications.

### [What evidence limits should CRA teams record when relying on standards, common specifications, or certification schemes?](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md#what-evidence-limits-should-cra-teams-record-when-relying-on-standards-common-specifications-or-certification-schemes)

*Module: [CRA Harmonised Standards](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)*

Record the exact version, OJ reference status where relevant, requirements covered, parts applied, product functions covered, processes covered, tests or assessments performed, and remaining risks or requirements handled by other means.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 supports requirement-by-requirement documentation of applied tools, parts applied, alternatives, and technical specifications.
- [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 4.1.7 supports recording uncovered risks and requirements when standards are partial or not used.

### [What are important products with digital elements under the CRA?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#what-are-important-products-with-digital-elements-under-the-cra)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

Important products are products with digital elements whose core functionality matches a product category in CRA Annex III.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 7(1) defines important products by core functionality matching Annex III; Annex III divides them into class I and class II.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 3.1 confirms that manufacturers should look at core functionality to decide whether a product is important or critical.

### [What are critical products with digital elements under the CRA?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#what-are-critical-products-with-digital-elements-under-the-cra)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

Critical products are products with digital elements whose core functionality matches a product category in CRA Annex IV.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 8(1) and Annex IV define critical products by core functionality matching an Annex IV category.
- [Commission Implementing Regulation (EU) 2025/2392](https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj/eng?ref=sorena.io) - This implementing regulation provides the technical descriptions used to interpret the important and critical product categories.

### [How should a manufacturer decide whether a product is important or critical?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#how-should-a-manufacturer-decide-whether-a-product-is-important-or-critical)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

Start with the product's core functionality: the main features and technical capabilities without which the product would not meet its intended purpose.

Sources for this answer:

- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Sections 3.1 and 3.4 state that core functionality, not mere feature presence, determines classification.
- [Draft Commission guidance on the Cyber Resilience Act](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 124 to 129 explain core functionality, intended purpose, technical documentation, and misrepresentation risks.
- [Commission Implementing Regulation (EU) 2025/2392](https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj/eng?ref=sorena.io) - The Commission FAQ identifies this act as the source of the technical descriptions for important and critical product categories.

### [Does a product become important or critical just because it includes an important or critical component?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#does-a-product-become-important-or-critical-just-because-it-includes-an-important-or-critical-component)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

No. The CRA says that integrating a product with the core functionality of an Annex III category does not by itself make the larger product subject to the important-product conformity routes.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 7(1) says integration of an Annex III product does not itself make the host product important.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 3.2 gives embedded-browser and secure-element examples and points back to the host product's core functionality.
- [Draft Commission guidance on the Cyber Resilience Act](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 126 and 136 explain that integrated important or critical functionality is not assessed in isolation for classification.

### [Can a product have extra functions and still be an important or critical product?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#can-a-product-have-extra-functions-and-still-be-an-important-or-critical-product)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

Yes. Additional or ancillary functions do not stop a product from being important or critical if the product's core functionality still matches a listed Annex III or Annex IV category.

Sources for this answer:

- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 3.4 explains additional functions, integrated functionality, SOAR/SIEM examples, and the smartphone example.
- [Draft Commission guidance on the Cyber Resilience Act](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 125 to 127 explain ancillary functions, broader or narrower functionality, and partial overlap.

### [What is the conformity assessment consequence for a class I important product?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#what-is-the-conformity-assessment-consequence-for-a-class-i-important-product)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

A class I important product can use the Article 32(1) procedures, including internal control based on module A, only when the Article 32(2) trigger is not met.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32(1) lists the baseline procedures; Article 32(2) sets the class I trigger for module B plus C or module H.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Sections 6.1 and 6.2 explain when module A is available and when module B plus C or module H is mandatory.

### [What conformity assessment routes apply to class II important products?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#what-conformity-assessment-routes-apply-to-class-ii-important-products)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

Class II important products must use one of the Article 32(3) routes.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32(3) sets the class II conformity assessment routes.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.2 states that module B plus C or H are mandatory for important products of class II, subject to the FOSS footnote.

### [What conformity assessment routes apply to critical products?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#what-conformity-assessment-routes-apply-to-critical-products)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

Critical products follow Article 32(4). The first route is a European cybersecurity certification scheme in accordance with Article 8(1), if the Article 8(1) conditions are met.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 8(1) describes the certification route for critical products; Article 32(4) gives the fallback to Article 32(3) where Article 8(1) conditions are not met.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.2 describes critical products as using module B plus C or H unless future Article 8(1) certification becomes mandatory.

### [Does important or critical status change the cybersecurity requirements themselves?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#does-important-or-critical-status-change-the-cybersecurity-requirements-themselves)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

No. Important or critical status mainly changes the conformity assessment route before placing the product on the market.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Articles 6, 13, and 32 connect essential requirements, manufacturer risk assessment, and conformity assessment routes.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 3.3 explains that all products require a comprehensive cybersecurity risk assessment regardless of important or critical status.
- [Draft Commission guidance on the Cyber Resilience Act](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Point 122 describes classification as relevant to the conformity assessment procedure.

### [If only the core functionality drives classification, is only that core function assessed?](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md#if-only-the-core-functionality-drives-classification-is-only-that-core-function-assessed)

*Module: [CRA Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)*

No. Core functionality determines the product class and route, but the conformity assessment still covers the product as a whole.

Sources for this answer:

- [Draft Commission guidance on the Cyber Resilience Act](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 131 and 135 to 139 explain whole-product assessment and limits on presumption of conformity when a standard covers only part of the product's risks.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32 requires conformity assessment of the product and the manufacturer's processes against the essential cybersecurity requirements.

## FAQ Pagination

- Canonical index (page 1): [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md)
- Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL.
- Current page: 10 of 42

Pages: [1](/artifacts/eu/cyber-resilience-act/faq/items.md) | [2](/artifacts/eu/cyber-resilience-act/faq/items/page/2.md) | [3](/artifacts/eu/cyber-resilience-act/faq/items/page/3.md) | [4](/artifacts/eu/cyber-resilience-act/faq/items/page/4.md) | [5](/artifacts/eu/cyber-resilience-act/faq/items/page/5.md) | [6](/artifacts/eu/cyber-resilience-act/faq/items/page/6.md) | [7](/artifacts/eu/cyber-resilience-act/faq/items/page/7.md) | [8](/artifacts/eu/cyber-resilience-act/faq/items/page/8.md) | [9](/artifacts/eu/cyber-resilience-act/faq/items/page/9.md) | [10](/artifacts/eu/cyber-resilience-act/faq/items/page/10.md) | [11](/artifacts/eu/cyber-resilience-act/faq/items/page/11.md) | [12](/artifacts/eu/cyber-resilience-act/faq/items/page/12.md) | [13](/artifacts/eu/cyber-resilience-act/faq/items/page/13.md) | [14](/artifacts/eu/cyber-resilience-act/faq/items/page/14.md) | [15](/artifacts/eu/cyber-resilience-act/faq/items/page/15.md) | [16](/artifacts/eu/cyber-resilience-act/faq/items/page/16.md) | [17](/artifacts/eu/cyber-resilience-act/faq/items/page/17.md) | [18](/artifacts/eu/cyber-resilience-act/faq/items/page/18.md) | [19](/artifacts/eu/cyber-resilience-act/faq/items/page/19.md) | [20](/artifacts/eu/cyber-resilience-act/faq/items/page/20.md) | [21](/artifacts/eu/cyber-resilience-act/faq/items/page/21.md) | [22](/artifacts/eu/cyber-resilience-act/faq/items/page/22.md) | [23](/artifacts/eu/cyber-resilience-act/faq/items/page/23.md) | [24](/artifacts/eu/cyber-resilience-act/faq/items/page/24.md) | [25](/artifacts/eu/cyber-resilience-act/faq/items/page/25.md) | [26](/artifacts/eu/cyber-resilience-act/faq/items/page/26.md) | [27](/artifacts/eu/cyber-resilience-act/faq/items/page/27.md) | [28](/artifacts/eu/cyber-resilience-act/faq/items/page/28.md) | [29](/artifacts/eu/cyber-resilience-act/faq/items/page/29.md) | [30](/artifacts/eu/cyber-resilience-act/faq/items/page/30.md) | [31](/artifacts/eu/cyber-resilience-act/faq/items/page/31.md) | [32](/artifacts/eu/cyber-resilience-act/faq/items/page/32.md) | [33](/artifacts/eu/cyber-resilience-act/faq/items/page/33.md) | [34](/artifacts/eu/cyber-resilience-act/faq/items/page/34.md) | [35](/artifacts/eu/cyber-resilience-act/faq/items/page/35.md) | [36](/artifacts/eu/cyber-resilience-act/faq/items/page/36.md) | [37](/artifacts/eu/cyber-resilience-act/faq/items/page/37.md) | [38](/artifacts/eu/cyber-resilience-act/faq/items/page/38.md) | [39](/artifacts/eu/cyber-resilience-act/faq/items/page/39.md) | [40](/artifacts/eu/cyber-resilience-act/faq/items/page/40.md) | [41](/artifacts/eu/cyber-resilience-act/faq/items/page/41.md) | [42](/artifacts/eu/cyber-resilience-act/faq/items/page/42.md)

[Previous page](/artifacts/eu/cyber-resilience-act/faq/items/page/9.md) | [Next page](/artifacts/eu/cyber-resilience-act/faq/items/page/11.md)

*Recommended next step*

*Placement: after the FAQ summaries*

## Turn CRA FAQ answers into product evidence

Use these CRA FAQ summaries to assign scope checks, role mapping, risk-assessment evidence, vulnerability-reporting intake, conformity-assessment records, CE marking controls, support-period rationale, and market-surveillance readiness tasks.

- [Open Assessment Autopilot](/solutions/assessment.md): Convert CRA scope, role, support-period, and conformity questions into evidence requests and review tasks.
- [Talk through CRA readiness](/contact.md): Review product boundaries, launch blockers, vulnerability-handling evidence, and market-access records with the Sorena team.


---

[Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/10