---
title: "EU Cyber Resilience Act FAQ"
canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq"
source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/2"
author: "Sorena AI"
description: "Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance."
published_at: "2026-03-10"
updated_at: "2026-03-10"
keywords:
  - "Cyber Resilience Act FAQ"
  - "CRA scope"
  - "CRA essential cybersecurity requirements"
  - "CRA vulnerability reporting"
  - "CRA CE marking"
  - "Cyber Resilience Act"
  - "CRA FAQ"
  - "products with digital elements"
  - "CE marking"
  - "vulnerability reporting"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# EU Cyber Resilience Act FAQ

Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance.

*FAQ* *EU* *Cyber Resilience Act*

## EU Cyber Resilience Act FAQ

Straight answers to the CRA questions that decide whether a product can be placed on the EU market and what evidence must exist before launch.

This page helps orient product, engineering, security, compliance, legal, importer, distributor, and market-access reviews.

The EU Cyber Resilience Act applies horizontal cybersecurity rules to products with digital elements. This FAQ summarizes the core market-access questions: what is in scope, who carries each role, what manufacturers must build and document, when vulnerability reports are triggered, how conformity assessment and CE marking work, how long support must last, and what market surveillance authorities can check.

## Browse sub-FAQ modules

### [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)

CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions.

- 33 items

### [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)

Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence.

- 15 items

### [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)

Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records.

- 14 items

### [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)

Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route.

- 25 items

### [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md)

CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence.

- 5 items

### [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md)

FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties.

- 16 items

### [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md)

CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls.

- 27 items

### [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md)

CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information.

- 20 items

### [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md)

FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes.

- 14 items

### [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)

Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence.

- 21 items

### [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)

FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences.

- 13 items

### [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md)

Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility.

- 22 items

### [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md)

Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates.

- 12 items

### [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md)

FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence.

- 14 items

### [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md)

Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records.

- 22 items

### [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md)

FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls.

- 17 items

### [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md)

Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties.

- 39 items

### [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md)

CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes.

- 32 items

### [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md)

CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records.

- 31 items

### [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md)

Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work.

- 23 items

### [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md)

Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations.

- 40 items

### [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md)

Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths.

- 26 items

### [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md)

FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs.

- 17 items

### [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md)

CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment.

- 16 items

### [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)

EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries.

- 35 items

### [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)

FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information.

- 16 items

### [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)

Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence.

- 21 items

### [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md)

Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products.

- 17 items

### [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md)

Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review.

- 24 items

### [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md)

Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties.

- 20 items

### [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md)

Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence.

- 16 items

### [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md)

FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document.

- 13 items

### [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md)

CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access.

- 19 items

### [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md)

CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions.

- 23 items

### [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md)

FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits.

- 25 items

### [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md)

Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information.

- 17 items

### [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md)

Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices.

- 17 items

### [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md)

FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires.

- 16 items

### [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md)

CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification.

- 16 items

### [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)

CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes.

- 17 items

Browse all indexed questions: [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md)

## All FAQ items

*Page 2 of 42. Showing 20 of 826 items.*

### [Under CRA Blue Guide concepts, is a personal import after an in-person third-country purchase placing on the market?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#under-cra-blue-guide-concepts-is-a-personal-import-after-an-in-person-third-country-purchase-placing-on-the-market)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

No.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on personal third-country purchases carried into the EU being outside placing on the market; section 2.3, including footnote 50.

### [Does manufacturing for one's own use count as placing on the market under the CRA?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#does-manufacturing-for-ones-own-use-count-as-placing-on-the-market-under-the-cra)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

Usually no.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on own-use manufacturing and the CRA scope treatment for products developed only for internal use; section 2.3.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on own-use manufacturing and the CRA scope treatment for products developed only for internal use; section 1.5.

### [What is "putting into service," and does it usually matter under CRA Blue Guide concepts?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#what-is-putting-into-service-and-does-it-usually-matter-under-cra-blue-guide-concepts)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

The Blue Guide defines it as the first use of a product within the Union by the end user for its intended purpose.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on putting into service and why CRA generally uses placing-on-the-market and making-available triggers instead; section 2.6.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on putting into service and why CRA generally uses placing-on-the-market and making-available triggers instead; Article 3(21), Article 3(22), Article 6 and Article 13.

### [Under CRA Blue Guide transition concepts, can a product lawfully placed on the market before new rules still be sold later?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#under-cra-blue-guide-transition-concepts-can-a-product-lawfully-placed-on-the-market-before-new-rules-still-be-sold-later)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

Yes, in principle.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on lawfully placed products continuing through later distribution unless the new law provides otherwise; sections 2.3, 2.10 and 4.1.2.5.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on lawfully placed products continuing through later distribution unless the new law provides otherwise; sections 1.4 and 7.2.

### [Under CRA Blue Guide transition concepts, can lawfully placed stock stay in a distributor warehouse and still be sold later?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#under-cra-blue-guide-transition-concepts-can-lawfully-placed-stock-stay-in-a-distributor-warehouse-and-still-be-sold-later)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

Yes.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on already placed distributor stock being later made available without a new placement event; sections 2.3 and 2.10.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on already placed distributor stock being later made available without a new placement event; section 7.2.

### [Under CRA Blue Guide concepts, does repeated renting create a new placing-on-the-market event?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#under-cra-blue-guide-concepts-does-repeated-renting-create-a-new-placing-on-the-market-event)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

No.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on repeated renting of the same product not creating a new placing-on-the-market event; section 2.3.

### [Under CRA Blue Guide concepts, are prototypes or pre-production units at trade fairs already placed on the market?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#under-cra-blue-guide-concepts-are-prototypes-or-pre-production-units-at-trade-fairs-already-placed-on-the-market)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

No, provided the Blue Guide and CRA conditions are met.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on trade-fair and demonstration prototypes not being placed on the market when marked and controlled as non-compliant; section 2.3.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on trade-fair and demonstration prototypes not being placed on the market when marked and controlled as non-compliant; Article 4(2) and recital 36.

### [Under the CRA, can unfinished software be made available for testing before full compliance?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#under-the-cra-can-unfinished-software-be-made-available-for-testing-before-full-compliance)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

Yes, but only under a narrow CRA exception.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on the CRA unfinished-software testing exception for alpha, beta and release-candidate software; Article 4(3) and recital 37.
- [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on the CRA unfinished-software testing exception for alpha, beta and release-candidate software; section 2.3, including footnote 7.

### [Why does the Blue Guide matter for technical documentation and declarations of conformity under the CRA?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#why-does-the-blue-guide-matter-for-technical-documentation-and-declarations-of-conformity-under-the-cra)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

Because the CRA uses the same NLF documentation logic.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on technical documentation and EU declaration of conformity logic under CRA and the Blue Guide; sections 4.3 and 4.4.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on technical documentation and EU declaration of conformity logic under CRA and the Blue Guide; Article 28(3), Article 31 and Annex VII.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on technical documentation and EU declaration of conformity logic under CRA and the Blue Guide; sections 4.1.8, 6.6 and 6.8.

### [Why does the Blue Guide matter for intended purpose and reasonably foreseeable use under the CRA?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#why-does-the-blue-guide-matter-for-intended-purpose-and-reasonably-foreseeable-use-under-the-cra)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

Because the CRA uses the same product-law logic that compliance cannot be assessed only against the manufacturer's preferred use case.

Sources for this answer:

- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Supports the answer on intended purpose, reasonably foreseeable use and misuse in CRA risk assessment and user information; sections 2.8 and 3.1.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Supports the answer on intended purpose, reasonably foreseeable use and misuse in CRA risk assessment and user information; sections 4.1.4, 4.1.5, 4.1.7 and 4.1.8.

### [How are CRA Blue Guide market-placement concepts applied to standalone software supplied digitally?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#how-are-cra-blue-guide-market-placement-concepts-applied-to-standalone-software-supplied-digitally)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

For software, the CRA follows the same NLF concepts, but the draft Commission guidance explains how they work in a digital delivery model.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on draft CRA guidance on digital supply of standalone software and the first offering as placement; Article 3(21) and Article 3(22).
- [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on draft CRA guidance on digital supply of standalone software and the first offering as placement; section 2.1, points 10 to 14.

### [Under CRA Blue Guide concepts, does a later non-substantial software version get a new placing-on-the-market date?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#under-cra-blue-guide-concepts-does-a-later-non-substantial-software-version-get-a-new-placing-on-the-market-date)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

No.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on draft CRA guidance on non-substantial software iterations not creating a new placement date; Article 3(30) and recital 41.
- [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on draft CRA guidance on non-substantial software iterations not creating a new placement date; section 2.1, points 15 and 16.

### [Under CRA Blue Guide concepts, does the same software-placement rule apply to physical media or hardware bundles?](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md#under-cra-blue-guide-concepts-does-the-same-software-placement-rule-apply-to-physical-media-or-hardware-bundles)

*Module: [CRA Blue Guide Concepts](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)*

No.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Supports the answer on draft CRA guidance distinguishing standalone digital software from physical media and hardware bundles; Article 3(1).
- [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the answer on draft CRA guidance distinguishing standalone digital software from physical media and hardware bundles; section 2.1, point 16, and section 2.2, points 17 to 19.

### [What does the CE marking mean under the CRA?](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md#what-does-the-ce-marking-mean-under-the-cra)

*Module: [CRA CE Marking](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)*

The CE marking is the manufacturer's visible self-declaration that the product with digital elements complies with the CRA and any other applicable EU harmonisation law that also requires CE marking.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Articles 29 and 30 set the CRA CE-marking rules; Article 13 links affixing the mark to demonstrated conformity.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.7 explains CE marking as the manufacturer's visual self-declaration for CRA and other applicable New Legislative Framework laws.
- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 4.5.1.1 explains the general EU product-law meaning of CE marking and the manufacturer's responsibility.

### [When can a manufacturer affix the CRA CE marking?](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md#when-can-a-manufacturer-affix-the-cra-ce-marking)

*Module: [CRA CE Marking](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)*

Only after the applicable CRA conformity assessment procedure has been completed with a positive result. The mark must be affixed before the product with digital elements is placed on the market.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(12) requires technical documentation and conformity assessment before the EU declaration and CE marking; Article 30(3) requires affixing before placing on the market.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Sections 6.1 to 6.3 describe the conformity assessment activities that precede CE marking under modules A, B+C, and H.

### [Which CRA conformity assessment routes can lead to CE marking?](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md#which-cra-conformity-assessment-routes-can-lead-to-ce-marking)

*Module: [CRA CE Marking](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)*

Article 32 recognises internal control under module A, EU-type examination followed by conformity to type under modules B+C, full quality assurance under module H, and, where available and applicable, specified European cybersecurity certification schemes.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32 lists module A, modules B+C, module H, and available applicable certification schemes; paragraphs 2 and 3 set additional rules for important and critical products.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Sections 6.1, 6.2, and 6.3 explain the practical differences between module A, module B+C, and module H.

### [Does CRA CE marking require a notified body number?](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md#does-cra-ce-marking-require-a-notified-body-number)

*Module: [CRA CE Marking](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)*

Not always. Under the CRA, the notified body's identification number follows the CE marking where the notified body is involved in conformity assessment based on full quality assurance, module H.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 30(4) links the notified-body identification number after the CE marking to full quality assurance under module H.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Sections 6.2, 6.3, and 6.9 explain notified-body involvement in CRA conformity assessment routes.

### [Where must the CE marking appear for hardware and physical products?](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md#where-must-the-ce-marking-appear-for-hardware-and-physical-products)

*Module: [CRA CE Marking](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)*

The CRA rule is product first: the CE marking must be visible, legible, and indelible on the product with digital elements. If that is not possible or not warranted because of the product's nature, it must be put on the packaging and on the EU declaration of conformity accompanying the product.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 30(1) sets the product, packaging, declaration, and software placement rules.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.7 explains the visibility rule, the general size rule, and why reduced visibility cannot be justified by aesthetics alone.

### [Where does the CE marking go for software products?](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md#where-does-the-ce-marking-go-for-software-products)

*Module: [CRA CE Marking](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)*

For a product with digital elements in the form of software, the CRA allows the CE marking either on the EU declaration of conformity or on the website accompanying the software product.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 30(1) gives the CRA-specific software placement option for the EU declaration of conformity or accompanying website.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.7 repeats the software placement option and the requirement for easy and direct consumer access.

### [What size, format, and visibility checks matter before release?](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md#what-size-format-and-visibility-checks-matter-before-release)

*Module: [CRA CE Marking](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)*

The CE marking must follow the general CE-marking principles in Regulation (EC) No 765/2008 and the CRA's visible, legible, and indelible placement rule. The Commission FAQ states the general rule that the mark has to be larger than 5 mm, with exceptions only where the product's size does not allow it and visibility remains preserved.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 29 applies the general CE-marking principles; Article 30(1) and (2) set CRA affixing and proportion requirements.
- [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.7 explains the 5 mm general rule, visibility expectations, and the limit on aesthetic exceptions.
- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 4.5.1.4 provides general CE-marking placement guidance for products, packaging, and accompanying documents.

## FAQ Pagination

- Canonical index (page 1): [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md)
- Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL.
- Current page: 2 of 42

Pages: [1](/artifacts/eu/cyber-resilience-act/faq/items.md) | [2](/artifacts/eu/cyber-resilience-act/faq/items/page/2.md) | [3](/artifacts/eu/cyber-resilience-act/faq/items/page/3.md) | [4](/artifacts/eu/cyber-resilience-act/faq/items/page/4.md) | [5](/artifacts/eu/cyber-resilience-act/faq/items/page/5.md) | [6](/artifacts/eu/cyber-resilience-act/faq/items/page/6.md) | [7](/artifacts/eu/cyber-resilience-act/faq/items/page/7.md) | [8](/artifacts/eu/cyber-resilience-act/faq/items/page/8.md) | [9](/artifacts/eu/cyber-resilience-act/faq/items/page/9.md) | [10](/artifacts/eu/cyber-resilience-act/faq/items/page/10.md) | [11](/artifacts/eu/cyber-resilience-act/faq/items/page/11.md) | [12](/artifacts/eu/cyber-resilience-act/faq/items/page/12.md) | [13](/artifacts/eu/cyber-resilience-act/faq/items/page/13.md) | [14](/artifacts/eu/cyber-resilience-act/faq/items/page/14.md) | [15](/artifacts/eu/cyber-resilience-act/faq/items/page/15.md) | [16](/artifacts/eu/cyber-resilience-act/faq/items/page/16.md) | [17](/artifacts/eu/cyber-resilience-act/faq/items/page/17.md) | [18](/artifacts/eu/cyber-resilience-act/faq/items/page/18.md) | [19](/artifacts/eu/cyber-resilience-act/faq/items/page/19.md) | [20](/artifacts/eu/cyber-resilience-act/faq/items/page/20.md) | [21](/artifacts/eu/cyber-resilience-act/faq/items/page/21.md) | [22](/artifacts/eu/cyber-resilience-act/faq/items/page/22.md) | [23](/artifacts/eu/cyber-resilience-act/faq/items/page/23.md) | [24](/artifacts/eu/cyber-resilience-act/faq/items/page/24.md) | [25](/artifacts/eu/cyber-resilience-act/faq/items/page/25.md) | [26](/artifacts/eu/cyber-resilience-act/faq/items/page/26.md) | [27](/artifacts/eu/cyber-resilience-act/faq/items/page/27.md) | [28](/artifacts/eu/cyber-resilience-act/faq/items/page/28.md) | [29](/artifacts/eu/cyber-resilience-act/faq/items/page/29.md) | [30](/artifacts/eu/cyber-resilience-act/faq/items/page/30.md) | [31](/artifacts/eu/cyber-resilience-act/faq/items/page/31.md) | [32](/artifacts/eu/cyber-resilience-act/faq/items/page/32.md) | [33](/artifacts/eu/cyber-resilience-act/faq/items/page/33.md) | [34](/artifacts/eu/cyber-resilience-act/faq/items/page/34.md) | [35](/artifacts/eu/cyber-resilience-act/faq/items/page/35.md) | [36](/artifacts/eu/cyber-resilience-act/faq/items/page/36.md) | [37](/artifacts/eu/cyber-resilience-act/faq/items/page/37.md) | [38](/artifacts/eu/cyber-resilience-act/faq/items/page/38.md) | [39](/artifacts/eu/cyber-resilience-act/faq/items/page/39.md) | [40](/artifacts/eu/cyber-resilience-act/faq/items/page/40.md) | [41](/artifacts/eu/cyber-resilience-act/faq/items/page/41.md) | [42](/artifacts/eu/cyber-resilience-act/faq/items/page/42.md)

[Previous page](/artifacts/eu/cyber-resilience-act/faq/items.md) | [Next page](/artifacts/eu/cyber-resilience-act/faq/items/page/3.md)

*Recommended next step*

*Placement: after the FAQ summaries*

## Turn CRA FAQ answers into product evidence

Use these CRA FAQ summaries to assign scope checks, role mapping, risk-assessment evidence, vulnerability-reporting intake, conformity-assessment records, CE marking controls, support-period rationale, and market-surveillance readiness tasks.

- [Open Assessment Autopilot](/solutions/assessment.md): Convert CRA scope, role, support-period, and conformity questions into evidence requests and review tasks.
- [Talk through CRA readiness](/contact.md): Review product boundaries, launch blockers, vulnerability-handling evidence, and market-access records with the Sorena team.


---

[Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/2