Search every question across sub-FAQs

No.

Recital 39 says that when assessing whether a feature update is a substantial modification, it is not relevant whether the feature update is provided separately or in combination with a security update. What matters is the effect on intended purpose and cybersecurity risk, not the packaging of the release.

The March 2026 draft guidance says this should be interpreted practically and proportionately.

Reasonable operational effort does not itself count as additional costs. The guidance gives examples such as personnel time, routine testing, configuration adjustments, and upgrades of underlying software dependencies that are necessary to address end-of-life components or known vulnerabilities. By contrast, additional costs mean burdens going beyond normal software maintenance, such as mandatory purchases of new hardware, infrastructure replacement, or fundamental changes to the operating environment.

No.

The March 2026 draft guidance says that regardless of whether a software update qualifies as a substantial modification, manufacturers remain responsible for the security of the update and of the product during the support period. It also says the cybersecurity risk assessment and technical documentation must remain accurate, complete, and continuously up to date. That aligns with Articles 13(7) and 31(2).

Record which changes remediate identified security issues, which changes add or alter functionality, and why separating them was or was not technically feasible. The record should link the release to the vulnerability assessment, affected versions and components, user advisory, update-distribution evidence, tests, and the updated cybersecurity risk assessment and technical documentation.

Run the substantial-modification test on the release's actual effects, not its label or packaging. If the functional part changes intended purpose or introduces cybersecurity risks that the original assessment did not cover, the manufacturer may need a new conformity assessment before placing the substantially modified version on the market. This record is practical evidence, not an official CRA form.

A CRA substantial modification is a change made after a product with digital elements has been placed on the market that affects the product's compliance with Annex I Part I essential cybersecurity requirements or changes the intended purpose for which the product was assessed.

The test is about the change's cybersecurity and intended-purpose effect. A release note label such as patch, upgrade, repair, maintenance, hotfix, or feature update does not decide the answer by itself.

No. Software development is iterative, and the CRA guidance expects a case-by-case assessment.

A later software iteration is not substantial merely because the code changed. Assess whether the update introduces new or increased cybersecurity risks that were not already covered in the original risk assessment, affects compliance with the essential requirements, or changes the product's assessed intended purpose.

Usually no. A security update whose purpose is to reduce cybersecurity risk, and that does not change the product's intended purpose or introduce new cybersecurity risks, should generally not be treated as a substantial modification.

That remains true even if the update changes internal implementation or constrains an existing feature solely to mitigate a vulnerability.

Yes. A security-driven change can still be substantial if it moves the product beyond the intended purpose originally assessed or introduces new risks that were not foreseen in the original cybersecurity risk assessment.

Examples from the draft guidance include security updates that move local processing to a remote service, change the trust model, add new external dependencies, or materially change data flows.

Start with the original intended purpose, architecture, threat model, risk assessment, technical documentation, and release scope. Then check whether the update changes the cybersecurity risk profile in a way the original assessment did not cover.

New functionality is more likely to be substantial when it changes the product's intended purpose as a whole or introduces cybersecurity risks that were not considered and mitigated in the original risk assessment.

A large feature is not required. A small-looking addition can be substantial if it changes the attack surface or risk profile in a way that affects compliance with the essential requirements.

Yes, if the later functionality and its risks were already included in the original intended purpose, cybersecurity risk assessment, mitigations, and technical documentation.

The practical evidence should show that the update implements a foreseen design path rather than expanding the product into a new intended use or unassessed risk profile.

No. Repairs, maintenance, and refurbishment do not necessarily lead to a substantial modification when the product's intended purpose, functionality, and cybersecurity risk level remain unaffected.

The repair becomes more sensitive when it changes how core functions operate, changes intended purpose, or affects compliance with Annex I Part I requirements.

No. Replacing a defective or worn item with a better-performing part does not itself trigger substantial modification.

It becomes substantial only if the performance change or changed operation affects compliance with essential cybersecurity requirements or changes the intended purpose that was covered by the original risk assessment.

A non-identical spare part may itself be a CRA product because it does not fall within the identical-spare-parts exemption. That does not automatically mean the host product has been substantially modified.

For the host product, assess whether the replacement changes intended purpose, functions, interoperability assumptions, cybersecurity risk profile, or compliance with Annex I Part I. For the spare part itself, assess CRA compliance in light of its own intended purpose and any compatibility or interoperability constraints.

An importer or distributor that carries out a substantial modification is treated as the manufacturer under Article 21. For another natural or legal person, Article 22 requires both carrying out a substantial modification and making the modified product available on the market.

If the original manufacturer makes the substantial modification, it remains the manufacturer. If another party makes the substantial modification and makes the modified product available on the market, that party can become responsible for the relevant CRA manufacturer obligations.