---
title: "EU Cyber Resilience Act FAQ"
canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq"
source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/27"
author: "Sorena AI"
description: "Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance."
published_at: "2026-03-10"
updated_at: "2026-03-10"
keywords:
  - "Cyber Resilience Act FAQ"
  - "CRA scope"
  - "CRA essential cybersecurity requirements"
  - "CRA vulnerability reporting"
  - "CRA CE marking"
  - "Cyber Resilience Act"
  - "CRA FAQ"
  - "products with digital elements"
  - "CE marking"
  - "vulnerability reporting"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# EU Cyber Resilience Act FAQ

Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance.

*FAQ* *EU* *Cyber Resilience Act*

## EU Cyber Resilience Act FAQ

Straight answers to the CRA questions that decide whether a product can be placed on the EU market and what evidence must exist before launch.

This page helps orient product, engineering, security, compliance, legal, importer, distributor, and market-access reviews.

The EU Cyber Resilience Act applies horizontal cybersecurity rules to products with digital elements. This FAQ summarizes the core market-access questions: what is in scope, who carries each role, what manufacturers must build and document, when vulnerability reports are triggered, how conformity assessment and CE marking work, how long support must last, and what market surveillance authorities can check.

## Browse sub-FAQ modules

### [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md)

CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions.

- 33 items

### [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md)

Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence.

- 15 items

### [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)

Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records.

- 14 items

### [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)

Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route.

- 25 items

### [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md)

CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence.

- 5 items

### [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md)

FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties.

- 16 items

### [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md)

CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls.

- 27 items

### [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md)

CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information.

- 20 items

### [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md)

FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes.

- 14 items

### [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md)

Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence.

- 21 items

### [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md)

FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences.

- 13 items

### [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md)

Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility.

- 22 items

### [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md)

Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates.

- 12 items

### [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md)

FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence.

- 14 items

### [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md)

Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records.

- 22 items

### [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md)

FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls.

- 17 items

### [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md)

Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties.

- 39 items

### [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md)

CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes.

- 32 items

### [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md)

CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records.

- 31 items

### [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md)

Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work.

- 23 items

### [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md)

Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations.

- 40 items

### [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md)

Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths.

- 26 items

### [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md)

FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs.

- 17 items

### [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md)

CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment.

- 16 items

### [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)

EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries.

- 35 items

### [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md)

FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information.

- 16 items

### [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md)

Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence.

- 21 items

### [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md)

Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products.

- 17 items

### [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md)

Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review.

- 24 items

### [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md)

Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties.

- 20 items

### [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md)

Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence.

- 16 items

### [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md)

FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document.

- 13 items

### [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md)

CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access.

- 19 items

### [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md)

CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions.

- 23 items

### [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md)

FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits.

- 25 items

### [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md)

Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information.

- 17 items

### [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md)

Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices.

- 17 items

### [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md)

FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires.

- 16 items

### [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md)

CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification.

- 16 items

### [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)

CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes.

- 17 items

Browse all indexed questions: [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md)

## All FAQ items

*Page 27 of 42. Showing 20 of 826 items.*

### [Does every electronic product with embedded firmware automatically fall within the CRA?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#does-every-electronic-product-with-embedded-firmware-automatically-fall-within-the-cra)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

No.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(1) requires the direct or indirect logical or physical data-connection element in addition to digital content.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.3 gives examples of embedded-firmware products that remain outside scope where they do not exchange digital data.

### [What counts as a logical connection under the CRA?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#what-counts-as-a-logical-connection-under-the-cra)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

A logical connection is a virtual representation of a data connection implemented through a software interface.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(8) defines logical connection for the CRA scope test.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.3 gives practical logical-connection examples such as sockets, files, APIs, HTTPS, IMAP, and SMTP.

### [What counts as a physical connection under the CRA?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#what-counts-as-a-physical-connection-under-the-cra)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

A physical connection is a connection between electronic information systems or components implemented using physical means, including electrical, optical, mechanical, wired, or radio-based interfaces.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(9) defines physical connection for the CRA scope test.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.3 gives practical physical-connection examples such as USB, Ethernet, Wi-Fi, Bluetooth, and NFC.

### [Can a product still be in scope if it is only indirectly connected to a device or network?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#can-a-product-still-be-in-scope-if-it-is-only-indirectly-connected-to-a-device-or-network)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Yes.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(1), Article 3(10), and recital 9 support treating indirect connections as in-scope connection paths.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.3 explains why indirectly connected products can still be attack vectors.

### [Is a product outside scope if it has electronics but does not exchange digital data?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#is-a-product-outside-scope-if-it-has-electronics-but-does-not-exchange-digital-data)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Generally yes.

Sources for this answer:

- [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Draft points 23 to 25 distinguish digital data exchange from mere power or trigger signals.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(1) and Article 3(7) to (10) define the data-connection concepts used for the boundary.

### [Are websites themselves CRA products with digital elements?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#are-websites-themselves-cra-products-with-digital-elements)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Not necessarily.

Sources for this answer:

- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.2 says websites are not products with digital elements unless they support product functionality as remote data processing.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(1), Article 3(2), and recital 12 connect websites to scope only where they support product functionality as remote processing.

### [Is standalone SaaS itself a product with digital elements under the CRA?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#is-standalone-saas-itself-a-product-with-digital-elements-under-the-cra)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

No, not by itself.

Sources for this answer:

- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.2 distinguishes standalone SaaS from remote data processing designed for a product by or under the manufacturer.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(2) and recitals 11 to 12 define when remote data processing belongs to a product with digital elements.

### [When does remote data processing become part of a CRA product?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#when-does-remote-data-processing-become-part-of-a-cra-product)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Remote data processing is in the product boundary when three conditions align: data processing happens at a distance, the relevant software is designed and developed by the manufacturer or under the manufacturer's responsibility, and the product would be unable to perform one of its functions without that processing.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(2) defines remote data processing and recitals 11 to 12 explain when remote processing supports product functionality.
- [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - The draft remote data processing guidance distinguishes manufacturer-designed remote processing from generic third-party cloud or SaaS services.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.2 confirms that standalone SaaS is not itself a product with digital elements unless it meets the remote data processing definition for a product.

### [Are products manufactured only for the manufacturer's own use in CRA scope?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#are-products-manufactured-only-for-the-manufacturers-own-use-in-cra-scope)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Generally no.

Sources for this answer:

- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.5 applies the Blue Guide own-use boundary to CRA products.
- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 2.3 explains that placing on the market does not occur where a product is manufactured for one's own use.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(21) and Article 3(22) define making available and placing on the market.

### [Are internal development, configuration, or programming tools built only for the manufacturer's own use in scope?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#are-internal-development-configuration-or-programming-tools-built-only-for-the-manufacturers-own-use-in-scope)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Generally no, unless they are separately placed on the market.

Sources for this answer:

- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.5 applies the own-use boundary to manufacturer-only development, configuration, and programming tools.

### [Who is the manufacturer, importer, or distributor for CRA scope decisions?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#who-is-the-manufacturer-importer-or-distributor-for-cra-scope-decisions)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

The manufacturer is the party that develops, manufactures, or has the product designed, developed, or manufactured, and markets it under its own name or trademark. The importer is the EU-established party that places on the market a product bearing the name or trademark of a person established outside the Union. The distributor is another supply-chain party that makes the product available on the Union market without affecting its properties.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3 defines manufacturer, importer, distributor, economic operator, making available, and placing on the market for CRA role allocation.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ section 5 explains EU-established responsible-operator expectations for products from third-country manufacturers.
- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - The Blue Guide explains product-law role boundaries, including when an importer or distributor markets under its own name or trademark.

### [When does an importer or distributor become the CRA manufacturer?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#when-does-an-importer-or-distributor-become-the-cra-manufacturer)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

An importer or distributor becomes the manufacturer for CRA purposes if it places the product on the market under its own name or trademark, or if it carries out a substantial modification of a product that is already on the market.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 21 states when importers, distributors, or other persons become subject to manufacturer obligations after own-brand placement or substantial modification.
- [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - The Blue Guide describes the general product-law rule that own-brand marketing or modification can shift manufacturer responsibility.

### [Can a manufacturer release unfinished or non-compliant software for testing purposes under the CRA?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#can-a-manufacturer-release-unfinished-or-non-compliant-software-for-testing-purposes-under-the-cra)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Yes, under specific conditions.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 4(3) and recital 37 set the limited testing exception and visible non-compliance sign condition.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.6 confirms the testing scenario for non-compliant software versions.

### [What if a product was designed before 11 December 2027 but is first placed on the market on or after that date for CRA scope purposes?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#what-if-a-product-was-designed-before-11-december-2027-but-is-first-placed-on-the-market-on-or-after-that-date-for-cra-scope-purposes)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

It can still be in scope.

Sources for this answer:

- [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Draft section 2.6 and Example 7 address products designed before but first placed on the market after the main application date.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(1), Article 3(21), and Article 71(2) tie scope and application to market placement.

### [Do products placed on the market before 11 December 2027 fall under the CRA?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#do-products-placed-on-the-market-before-11-december-2027-fall-under-the-cra)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

As a rule, only if they are substantially modified from that date onward.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 69(2) to (3) states the pre-application product rule and the Article 14 reporting exception.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.4 explains the pre-11 December 2027 product rule and substantial-modification trigger.

### [Does the CRA apply to products developed or modified exclusively for national security or defence purposes?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#does-the-cra-apply-to-products-developed-or-modified-exclusively-for-national-security-or-defence-purposes)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

No.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(7) excludes products developed or modified exclusively for national security or defence purposes and classified-information processing products.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.8 explains the national-security and defence exclusion.

### [Are dual-use products excluded from the CRA just because they can also be used in defence contexts?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#are-dual-use-products-excluded-from-the-cra-just-because-they-can-also-be-used-in-defence-contexts)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

No.

Sources for this answer:

- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.8 states that dual-use products remain covered unless exclusively developed or modified for national security or defence.
- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(7) sets the exclusive national-security, defence, and classified-information exclusion.

### [Which products are expressly excluded because other Union legislation already applies?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#which-products-are-expressly-excluded-because-other-union-legislation-already-applies)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

The CRA does not apply to:

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(2) to (4) lists medical-device, vehicle type-approval, certified aviation, and marine-equipment exclusions.
- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.9 explains the Article 2 sectoral exclusions and related component boundaries.

### [Does the CRA identify an additional vehicle-related exclusion outside Article 2?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#does-the-cra-identify-an-additional-vehicle-related-exclusion-outside-article-2)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Yes.

Sources for this answer:

- [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - FAQ 1.9 identifies the Delegated Regulation (EU) 2025/1535 exclusion for certain Regulation (EU) No 168/2013 vehicle products.

### [Are there other products that may later be limited or excluded because sectoral rules already cover the same risks?](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md#are-there-other-products-that-may-later-be-limited-or-excluded-because-sectoral-rules-already-cover-the-same-risks)

*Module: [CRA Products With Digital Elements Scope](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md)*

Yes.

Sources for this answer:

- [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(5) empowers the Commission to limit or exclude products where other Union rules cover the same risks at the same or higher protection level.

## FAQ Pagination

- Canonical index (page 1): [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md)
- Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL.
- Current page: 27 of 42

Pages: [1](/artifacts/eu/cyber-resilience-act/faq/items.md) | [2](/artifacts/eu/cyber-resilience-act/faq/items/page/2.md) | [3](/artifacts/eu/cyber-resilience-act/faq/items/page/3.md) | [4](/artifacts/eu/cyber-resilience-act/faq/items/page/4.md) | [5](/artifacts/eu/cyber-resilience-act/faq/items/page/5.md) | [6](/artifacts/eu/cyber-resilience-act/faq/items/page/6.md) | [7](/artifacts/eu/cyber-resilience-act/faq/items/page/7.md) | [8](/artifacts/eu/cyber-resilience-act/faq/items/page/8.md) | [9](/artifacts/eu/cyber-resilience-act/faq/items/page/9.md) | [10](/artifacts/eu/cyber-resilience-act/faq/items/page/10.md) | [11](/artifacts/eu/cyber-resilience-act/faq/items/page/11.md) | [12](/artifacts/eu/cyber-resilience-act/faq/items/page/12.md) | [13](/artifacts/eu/cyber-resilience-act/faq/items/page/13.md) | [14](/artifacts/eu/cyber-resilience-act/faq/items/page/14.md) | [15](/artifacts/eu/cyber-resilience-act/faq/items/page/15.md) | [16](/artifacts/eu/cyber-resilience-act/faq/items/page/16.md) | [17](/artifacts/eu/cyber-resilience-act/faq/items/page/17.md) | [18](/artifacts/eu/cyber-resilience-act/faq/items/page/18.md) | [19](/artifacts/eu/cyber-resilience-act/faq/items/page/19.md) | [20](/artifacts/eu/cyber-resilience-act/faq/items/page/20.md) | [21](/artifacts/eu/cyber-resilience-act/faq/items/page/21.md) | [22](/artifacts/eu/cyber-resilience-act/faq/items/page/22.md) | [23](/artifacts/eu/cyber-resilience-act/faq/items/page/23.md) | [24](/artifacts/eu/cyber-resilience-act/faq/items/page/24.md) | [25](/artifacts/eu/cyber-resilience-act/faq/items/page/25.md) | [26](/artifacts/eu/cyber-resilience-act/faq/items/page/26.md) | [27](/artifacts/eu/cyber-resilience-act/faq/items/page/27.md) | [28](/artifacts/eu/cyber-resilience-act/faq/items/page/28.md) | [29](/artifacts/eu/cyber-resilience-act/faq/items/page/29.md) | [30](/artifacts/eu/cyber-resilience-act/faq/items/page/30.md) | [31](/artifacts/eu/cyber-resilience-act/faq/items/page/31.md) | [32](/artifacts/eu/cyber-resilience-act/faq/items/page/32.md) | [33](/artifacts/eu/cyber-resilience-act/faq/items/page/33.md) | [34](/artifacts/eu/cyber-resilience-act/faq/items/page/34.md) | [35](/artifacts/eu/cyber-resilience-act/faq/items/page/35.md) | [36](/artifacts/eu/cyber-resilience-act/faq/items/page/36.md) | [37](/artifacts/eu/cyber-resilience-act/faq/items/page/37.md) | [38](/artifacts/eu/cyber-resilience-act/faq/items/page/38.md) | [39](/artifacts/eu/cyber-resilience-act/faq/items/page/39.md) | [40](/artifacts/eu/cyber-resilience-act/faq/items/page/40.md) | [41](/artifacts/eu/cyber-resilience-act/faq/items/page/41.md) | [42](/artifacts/eu/cyber-resilience-act/faq/items/page/42.md)

[Previous page](/artifacts/eu/cyber-resilience-act/faq/items/page/26.md) | [Next page](/artifacts/eu/cyber-resilience-act/faq/items/page/28.md)

*Recommended next step*

*Placement: after the FAQ summaries*

## Turn CRA FAQ answers into product evidence

Use these CRA FAQ summaries to assign scope checks, role mapping, risk-assessment evidence, vulnerability-reporting intake, conformity-assessment records, CE marking controls, support-period rationale, and market-surveillance readiness tasks.

- [Open Assessment Autopilot](/solutions/assessment.md): Convert CRA scope, role, support-period, and conformity questions into evidence requests and review tasks.
- [Talk through CRA readiness](/contact.md): Review product boundaries, launch blockers, vulnerability-handling evidence, and market-access records with the Sorena team.


---

[Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/27