Search every question across CRA sub-FAQs

The CRA does not let the manufacturer stay silent.

If a manufacturer ceases operations and therefore cannot comply with the CRA, it must inform the relevant market surveillance authorities before the cessation takes effect and must also inform users of the affected products, by any available means and to the extent possible.

Yes.

The CRA says market surveillance authorities must monitor how manufacturers applied the Article 13(8) criteria when determining support periods.

Yes.

The CRA says ADCO must publish relevant statistics on categories of products with digital elements, including average support periods determined by manufacturers, and provide guidance with indicative support periods for product categories.

Yes.

Article 13(8) allows the Commission to adopt delegated acts specifying minimum support periods for specific product categories where market-surveillance data suggests inadequate support periods.

No.

Article 13(19) requires the end date of the support period to be specified at the time of purchase, including at least the month and year. So the disclosure has to give users an actual end date, not only a relative formula such as "five years from purchase" or "five years from activation".

No.

Article 13(8) says the support period must reflect the length of time during which the product is expected to be in use, but the January 2026 Commission FAQ adds that manufacturers are not expected to apply that as a simple one-factor shortcut. Except where the expected use time is less than five years, the manufacturer must determine the support period by taking the Article 13(8) criteria into account proportionately.

No.

The January 2026 Commission FAQ says that where the product is expected to be in use for less than five years, the support period must correspond to that expected use time without further consideration of the other criteria listed in Article 13(8). That is the CRA's specific exception to the normal five-year minimum.

No.

Article 52(16) says ADCO publishes statistics, including average support periods, and guidance with indicative support periods for product categories. Those are not themselves the same thing as binding minimum support periods. Binding category-specific minimums arise only if the Commission later adopts a delegated act under Article 13(8).

The January 2026 Commission FAQ treats that as a specific support-period scenario.

The FAQ says that some free and open-source software placed on the market may be monetised only through paid support services offered on a subscription basis. Because that software may remain in use after the user stops paying for support, the FAQ says the manufacturer is required to ensure a support period equal to the duration of the active subscription.

Yes.

The March 2026 draft guidance says that for continuously evolving software, the manufacturer may rely on Article 13(10) to stop addressing and remediating vulnerabilities for earlier substantially modified versions once users can upgrade to a later version free of charge and without additional costs. The guidance expressly notes that this may result in a shorter effective support period for those earlier versions, while the other vulnerability-handling obligations still continue.

The CRA does not create a broad general definition section for tailor-made products, but recital 64 and the Commission FAQ give the working test.

A tailor-made product is a product with digital elements fitted to a particular purpose for a particular business user, where the manufacturer and that business user have explicitly agreed different contractual terms.

Only two essential requirements are expressly subject to the tailor-made carve-out:

- secure-by-default configuration in Annex I Part I point (2)(b)

- free-of-charge dissemination of security updates in Annex I Part II point (8)

The carve-out does not remove the rest of the CRA.

No.

The manufacturer still has to comply with the CRA generally, including the cybersecurity risk assessment, technical documentation, conformity assessment, and the other applicable Annex I requirements. The tailor-made carve-out is limited to the two expressly identified requirements.

Not on the terms set out in recital 64 and Annex I.

The CRA carve-out is framed around a manufacturer and a business user agreeing different contractual terms. That makes this a business-user exception, not a consumer-product exception.

No.

A B2B product is not tailor-made merely because the customer is a business. The product must be fitted to a particular purpose for a particular business user, and the parties must explicitly agree different contractual terms.

No.

The Commission FAQ says a product is not tailor-made where it undergoes minor customisations before sale without specific contractual terms or arrangements. It gives examples such as CRM platforms sold to multiple businesses and platforms that allow customisation through plugins or APIs while remaining fundamentally the same product for every customer.

The Commission FAQ gives examples such as custom-developed hardware or software built for the needs of a specific business user, or products developed for integration into a specific customer's highly controlled environment, such as a closed or air-gapped environment, where specific contractual terms apply.

That does not create an automatic rule for all closed or industrial environments. The particular-purpose, particular-business-user, and explicit-contract criteria still have to be met.

No.

The Commission FAQ gives such environments only as examples of cases that may qualify where the product is developed for integration into a specific customer's environment and specific contractual terms apply. The environment by itself does not satisfy the CRA test.

Yes.

Recital 64 and the Commission FAQ both say the manufacturer and the business user must explicitly agree a different set of contractual terms.

Yes, but only because Annex I Part II point (8) allows deviation for tailor-made products where the manufacturer and a business user have otherwise agreed.

Without that explicit tailor-made agreement, security updates addressing identified security issues must be disseminated free of charge.