Search every question across sub-FAQs

No. The CRA separates the provisions.

Article 21 covers importers and distributors that carry out a substantial modification of a product already placed on the market. Article 22 covers other natural or legal persons where they carry out a substantial modification and make the modified product available on the market.

Article 22 narrows the obligation to the part affected by the substantial modification, unless the modification affects the cybersecurity of the product as a whole.

In practice, the evidence should explain the affected boundary. If the changed part alters shared authentication, update mechanisms, communications, data flows, remote processing, or other whole-product security assumptions, teams should expect the whole-product assessment to be relevant.

Where a substantial modification may affect CRA compliance or changes intended purpose, compliance should be verified again and, where applicable, the product should undergo a new conformity assessment.

If a third-party conformity assessment was used, a change that might lead to a substantial modification should be notified to the third party where applicable.

No. Existing tests and documentation can be reused for parts of the product that are not affected by the substantial modification.

The person placing the modified product on the market must still update the technical documentation for impacted requirements, demonstrate why unchanged parts do not need new evidence, take responsibility for the modified product's conformity, and draw the required declaration of conformity.

Keep enough evidence to show the change was assessed against the CRA test rather than only approved as an engineering release.

A useful file links the release scope to the original intended purpose, risk assessment, threat model, affected architecture, Annex I Part I controls, vulnerability-handling impact, user instructions, test results, conformity route, declaration status, and any third-party assessment notification.

Users should receive practical information tied to the actual change: what changed, whether action is needed, any configuration or security-update steps, changed support information, and any known constraints introduced by replacement parts or interoperability measures.

For security updates, the CRA separately requires security updates to be disseminated without delay and accompanied by advisory messages with relevant information, including potential user action. Where technically feasible, new security updates must be provided separately from functionality updates.

Products with digital elements placed on the market before 11 December 2027 are subject to CRA requirements only if, from that date, they are subject to a substantial modification.

The Commission FAQ gives a practical contrast: a non-substantial bug-fix update for a smart TV placed on the market in 2027 does not require bringing that TV into full CRA conformity, but a later update that adds smart-home-control functionality and qualifies as substantial does.

Yes. For products placed on the market before 11 December 2027 where the CRA was not applied at initial placement, the draft guidance says manufacturers must be able to demonstrate to a market surveillance authority that later updates do not constitute substantial modifications.

A cybersecurity risk assessment covering Article 13(2) elements, plus documented compliance reasoning, should make that position easier to support.

The manufacturer must comply with the CRA in its entirety before placing the substantially modified product on the market, and then for the duration of that product's support period.

Teams should treat this as a release gate: confirm product scope, update the risk assessment and technical documentation, choose or confirm the conformity assessment route, prepare conformity evidence, update user information, and confirm vulnerability-handling processes before the modified product is made available.

Article 22 does not automatically make every third-party modifier the manufacturer. For a natural or legal person other than an importer or distributor, the Article 22 trigger requires both a substantial modification and making the modified product available on the market.

A modification kept solely for the modifier's own use therefore does not meet that specific Article 22 market-availability trigger. Importers and distributors are governed separately by Article 21, and other EU or national rules may still apply. The facts should record who performed or commissioned the change, whether the product was supplied onward, and under whose name or trademark it was made available.

The CRA defines the Support Period as the period during which the manufacturer must ensure that vulnerabilities of a product with digital elements are handled effectively and in accordance with the CRA vulnerability-handling requirements.

Article 13(8) applies that obligation from placing on the market and throughout the Support Period. The obligation covers the product in its entirety, including integrated components.

No. The CRA sets a minimum of at least five years, but that is not a universal cap or safe default.

If the product with digital elements is expected to be in use for less than five years, the Support Period must correspond to that expected use time. If the product is reasonably expected to be used for longer than five years, the Commission FAQ says five years is not sufficient by itself and the manufacturer should consider the Article 13(8) criteria, which may require a longer period.

Article 13(8) requires the Support Period to reflect the length of time during which the product is expected to be in use.

The mandatory factors are reasonable user expectations, the nature of the product including intended purpose, and relevant Union law determining the lifetime of products with digital elements. Manufacturers may also consider support periods for similar products, availability of the operating environment, support periods of third-party integrated components that provide core functions, and relevant ADCO or Commission guidance.

The Commission FAQ adds an important guardrail: manufacturers are not expected to set support periods by simply copying expected use time, except where the expected use time is less than five years. The criteria must be considered proportionately.

Expected use is not only a support-period input. Article 13(3) requires the cybersecurity risk assessment to take into account the length of time the product is expected to be in use.

The Commission FAQ explains that manufacturers should consider product lifetime during design and development and prepare the product so that vulnerabilities, including component vulnerabilities, can be handled effectively throughout the Support Period.

A shorter Support Period is justified only where the product is expected to be in use for less than five years. In that case, the CRA says the Support Period must correspond to the expected use time.

The Commission FAQ gives examples such as a contact-tracing application intended for a pandemic and some software applications that become unavailable and are no longer in use once a subscription expires. Do not generalize that example to every subscription product; document why the product is genuinely unavailable or no longer in use after the relevant period.