--- title: "EU Cyber Resilience Act FAQ" canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq" source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/57" author: "Sorena AI" description: "Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance." published_at: "2026-03-10" updated_at: "2026-07-24" keywords: - "Cyber Resilience Act FAQ" - "CRA scope" - "CRA essential cybersecurity requirements" - "CRA vulnerability reporting" - "CRA CE marking" - "Cyber Resilience Act" - "CRA FAQ" - "products with digital elements" - "CE marking" - "vulnerability reporting" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # EU Cyber Resilience Act FAQ Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. *FAQ* *EU* *Cyber Resilience Act* ## EU Cyber Resilience Act FAQ Straight answers to the CRA questions that decide whether a product can be placed on the EU market and what evidence must exist before launch. This page helps orient product, engineering, security, compliance, legal, importer, distributor, and market-access reviews. The EU Cyber Resilience Act applies horizontal cybersecurity rules to products with digital elements made available on the Union market. Most obligations apply from 11 December 2027, while Article 14 reporting for actively exploited vulnerabilities and severe incidents starts on 11 September 2026. Use this overview to decide what is in scope, which economic operator carries each duty, what manufacturers must build and document, which conformity assessment route applies, how CE marking and support work, and what market surveillance authorities can check. Regulation (EU) 2024/2847 controls; the Commission-services FAQs cited here are non-binding interpretation. ## Definitions ### Products with digital elements Products with digital elements are software or hardware products and their remote data processing solutions, including software or hardware components placed on the market separately. CRA scope also requires Union-market availability and an intended or reasonably foreseeable direct or indirect logical or physical data connection, subject to the Article 2 exclusions. **Why it matters here:** This category sets the CRA product boundary. It can include standalone software, connected hardware, firmware, separately marketed components, and manufacturer-responsible remote processing needed for a product function. Sources: - [Regulation (EU) 2024/2847, Articles 2 and 3](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) ### Actively exploited vulnerability An actively exploited vulnerability is a vulnerability for which reliable evidence shows that a malicious actor exploited it in a system without the system owner's permission. A vulnerability found through good-faith testing is not actively exploited unless there is also reliable evidence of malicious exploitation. **Why it matters here:** This is one of the Article 14 reporting triggers from 11 September 2026. It is narrower than an exploitable vulnerability or a newly discovered zero-day vulnerability. Sources: - [Regulation (EU) 2024/2847, Articles 3(42) and 14](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) ### Support period The support period is the period during which the manufacturer must handle vulnerabilities effectively under CRA Annex I Part II. It must reflect the product's expected use and the factors in Article 13(8), and must last at least five years unless expected use is shorter. **Why it matters here:** The duration controls how long the manufacturer must operate vulnerability handling and affects security-update availability, user information, and record retention. The end date must be clear at purchase. Sources: - [Regulation (EU) 2024/2847, Articles 3(20) and 13(8)-(9), and Annex II](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) ## Browse sub-FAQ modules ### [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md) CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions. - 34 items ### [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md) Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence. - 15 items ### [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md) Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records. - 15 items ### [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md) Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route. - 25 items ### [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md) CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence. - 10 items ### [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md) FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties. - 16 items ### [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md) CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls. - 27 items ### [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md) CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information. - 20 items ### [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md) FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes. - 14 items ### [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md) Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence. - 22 items ### [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md) FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences. - 14 items ### [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md) Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility. - 23 items ### [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md) Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates. - 20 items ### [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md) FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence. - 14 items ### [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md) Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records. - 22 items ### [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md) FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls. - 17 items ### [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md) Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties. - 39 items ### [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md) CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes. - 32 items ### [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md) CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records. - 31 items ### [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md) Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work. - 23 items ### [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md) Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations. - 40 items ### [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md) Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths. - 26 items ### [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md) FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs. - 18 items ### [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md) CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment. - 17 items ### [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md) EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries. - 35 items ### [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md) FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information. - 16 items ### [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md) Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence. - 21 items ### [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md) Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products. - 18 items ### [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md) Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review. - 25 items ### [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md) Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties. - 21 items ### [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md) Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence. - 17 items ### [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md) FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document. - 14 items ### [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md) CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access. - 19 items ### [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md) CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions. - 24 items ### [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md) FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits. - 26 items ### [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md) Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information. - 17 items ### [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md) Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices. - 19 items ### [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md) FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires. - 16 items ### [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md) CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification. - 16 items ### [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md) CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes. - 18 items Browse all indexed questions: [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md) ## All FAQ items *Page 57 of 58. Showing 15 of 856 items.* ### [Are identical spare parts excluded from the CRA?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#are-identical-spare-parts-excluded-from-the-cra) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* Yes, but the exclusion is narrow. Article 2(6) excludes spare parts made available on the market to replace identical components in products with digital elements, when those spare parts are manufactured according to the same specifications as the components they replace. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(6) sets the identical-component and same-specification conditions for the spare-part exclusion; Recital 29 explains the repair and durability rationale. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 91 and 92 discuss the draft guidance view of identical spare parts. ### [Does the identical-spare-part exclusion cover legacy products?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#does-the-identical-spare-part-exclusion-cover-legacy-products) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* Yes. Recital 29 says the spare-part exemption is intended to cover spare parts used to repair legacy products made available before the CRA's date of application, as well as spare parts for products that have already undergone CRA conformity assessment. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Recital 29 expressly links the spare-part exemption to repair of legacy products and products already assessed under the CRA. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 91 and 92 address spare parts for legacy products and CRA-assessed products. ### [What if the replacement part is not identical to the original component?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#what-if-the-replacement-part-is-not-identical-to-the-original-component) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* Then Article 2(6) does not settle the matter. The non-identical spare part may need to be assessed as a product with digital elements in its own right if it is made available on the market and otherwise falls within CRA scope. Sources for this answer: - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Point 93 discusses non-identical spare parts and assessing them by intended purpose, compatibility, and interoperability. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(6) is limited to identical spare parts made to the same specifications. ### [Does installing a non-identical spare part automatically substantially modify the repaired product?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#does-installing-a-non-identical-spare-part-automatically-substantially-modify-the-repaired-product) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* No. The fact that the spare part is not covered by Article 2(6) does not automatically mean the repaired product has been substantially modified. Sources for this answer: - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Point 94 and the draft spare-part examples distinguish non-identical replacement analysis from automatic substantial modification. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(30) provides the legal test for substantial modification. ### [Is same function, same protocol, or same security mechanism enough for the spare-part exclusion?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#is-same-function-same-protocol-or-same-security-mechanism-enough-for-the-spare-part-exclusion) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* No. The Article 2(6) exclusion requires an identical component manufactured according to the same specifications. A replacement can keep the same function, protocols, or security mechanisms and still fall outside the exclusion if its specifications differ. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 2(6) uses identical-component and same-specification language for the exclusion. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Example 34 in the draft guidance illustrates a replacement that preserves function and security mechanisms but is not identical. ### [What if compatibility with an older product prevents a fully modern spare-part design?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#what-if-compatibility-with-an-older-product-prevents-a-fully-modern-spare-part-design) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* The manufacturer should treat the compatibility limit as a cybersecurity risk-assessment issue, not as a reason to ignore the CRA. Where a requirement is not applicable or cannot be met in the usual way because of product nature, interoperability, or compatibility, the risk assessment and technical documentation should explain why. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Recital 55 addresses requirements that are incompatible with product nature or interoperability; Article 13(3), Article 31(2), and Annex II ground risk assessment, technical documentation, and user information. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Point 29 discusses legacy-compatibility configurations, risk assessment, treatment measures, and user information; point 93 applies similar reasoning to non-identical spare parts. ### [Can a software fix or security update be maintenance rather than substantial modification?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#can-a-software-fix-or-security-update-be-maintenance-rather-than-substantial-modification) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* Yes, often. Recital 39 says a security update designed to decrease cybersecurity risk is not considered a substantial modification when it does not modify the product's intended purpose. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Recital 39 explains when security updates are generally not substantial modifications. - [European Commission CRA FAQs, version 1.3 (1 July 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 1.4 gives the smart-TV bug-fix example for a product placed on the market before 11 December 2027. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 101 to 106 discuss security updates, functionality updates, and substantial modification in the draft guidance. ### [When can a software update become a substantial modification?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#when-can-a-software-update-become-a-substantial-modification) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* A software update can become substantial when it changes the product's intended purpose or changes the type or performance of the product in a way that affects cybersecurity risk. The label attached to the release is not decisive. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Recital 39 distinguishes security updates and minor functionality updates from feature updates that modify original functions or increase cybersecurity risk. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 96 to 105 provide draft guidance on software updates and the substantial-modification analysis. ### [How do repairs and updates affect products placed on the market before 11 December 2027?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#how-do-repairs-and-updates-affect-products-placed-on-the-market-before-11-december-2027) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* For products with digital elements placed on the market before 11 December 2027, Article 69(2) says the CRA requirements apply only if, from that date, those products are subject to a substantial modification. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 69(2) provides the legacy-product substantial-modification trigger; Article 69(3) provides the Article 14 reporting derogation. - [European Commission CRA FAQs, version 1.3 (1 July 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Sections 1.4 and 5.3 explain legacy products, bug-fix updates, and the reporting obligations for pre-application products. ### [Are distributors required to bring old stock into CRA compliance just because they sell or repair it after 11 December 2027?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#are-distributors-required-to-bring-old-stock-into-cra-compliance-just-because-they-sell-or-repair-it-after-11-december-2027) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* No, not merely because they continue making those individual products available after that date. The Commission FAQ says products already placed on the market before 11 December 2027 are not subject to CRA requirements, except reporting obligations, unless they are substantially modified. Sources for this answer: - [European Commission CRA FAQs, version 1.3 (1 July 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 7.5 answers whether distributors must bring pre-11 December 2027 products into CRA compliance. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 21 covers when importer and distributor obligations become manufacturer obligations; Article 69(2) covers legacy-product substantial modification. ### [What happens if a repair, refurbishment, or update is a substantial modification?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#what-happens-if-a-repair-refurbishment-or-update-is-a-substantial-modification) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* The changed product is treated as a new product for the CRA analysis when it is made available on the market after the substantial modification. Compliance must be reassessed for the affected part, or for the whole product if the modification affects cybersecurity of the product as a whole. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 21 covers importers and distributors; Article 22 covers other persons who substantially modify products and make them available on the market. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 107 and 108 discuss the consequences of substantial modification in the draft guidance. ### [Does a substantial modification require rebuilding all documentation and testing from scratch?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#does-a-substantial-modification-require-rebuilding-all-documentation-and-testing-from-scratch) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* Not necessarily. The assessment should focus on the parts, risks, and requirements affected by the substantial modification. Sources for this answer: - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 109 and 110 discuss reusing unaffected documentation and focusing conformity work on substantially modified parts. - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Sections 2.1 and 4.3 explain repaired products, new products after modification, and conformity-assessment principles under EU product rules. ### [If a product is temporarily exported for repair and then returned, does that alone trigger a new CRA assessment?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#if-a-product-is-temporarily-exported-for-repair-and-then-returned-does-that-alone-trigger-a-new-cra-assessment) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* No. The Blue Guide says repaired products that are not considered new products do not need conformity assessment again, including where the product was temporarily exported to a third country for repair. Sources for this answer: - [Blue Guide 2022](https://ec.europa.eu/docsroom/documents/44906/attachments/2/translations/en/renditions/native?ref=sorena.io) - Section 2.1 discusses repaired products and temporary export for repair under EU product rules. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 3(30) and Recital 42 provide the CRA substantial-modification test for repairs. ### [How do spare parts and repairs interact with the CRA support period?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#how-do-spare-parts-and-repairs-interact-with-the-cra-support-period) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* Repair planning should not be separated from the support-period duties. Manufacturers must determine a support period that reflects expected use, and vulnerability handling and security updates must continue during that period according to the CRA requirements. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(8), Recitals 59 and 60, and Annex I Part II ground support-period determination and vulnerability-handling duties. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Point 29 and point 93 support documenting compatibility constraints, risk treatment, user information, and reassessment. ### [What evidence should a repair or spare-part decision keep?](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md#what-evidence-should-a-repair-or-spare-part-decision-keep) *Module: [EU Cyber Resilience Act Repairs and Spare Parts](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md)* Keep enough evidence to show which question was answered: spare-part exclusion, repair substantial-modification analysis, or both. Useful records include the replaced component's specifications, the replacement part's specifications, the intended purpose before and after repair, affected interfaces and data flows, cybersecurity risk-assessment updates, and any compensatory controls. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(3), Article 13(4), Article 13(18), Article 31(2), and Annex II support cybersecurity risk assessment, technical documentation, and user-information records. - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Points 88 to 94 support recording repair, spare-part identity, compatibility constraints, and substantial-modification reasoning. ## FAQ Pagination - Canonical index (page 1): [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md) - Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL. - Current page: 57 of 58 Pages: [1](/artifacts/eu/cyber-resilience-act/faq/items.md) | [2](/artifacts/eu/cyber-resilience-act/faq/items/page/2.md) | [3](/artifacts/eu/cyber-resilience-act/faq/items/page/3.md) | [4](/artifacts/eu/cyber-resilience-act/faq/items/page/4.md) | [5](/artifacts/eu/cyber-resilience-act/faq/items/page/5.md) | [6](/artifacts/eu/cyber-resilience-act/faq/items/page/6.md) | [7](/artifacts/eu/cyber-resilience-act/faq/items/page/7.md) | [8](/artifacts/eu/cyber-resilience-act/faq/items/page/8.md) | [9](/artifacts/eu/cyber-resilience-act/faq/items/page/9.md) | [10](/artifacts/eu/cyber-resilience-act/faq/items/page/10.md) | [11](/artifacts/eu/cyber-resilience-act/faq/items/page/11.md) | [12](/artifacts/eu/cyber-resilience-act/faq/items/page/12.md) | [13](/artifacts/eu/cyber-resilience-act/faq/items/page/13.md) | [14](/artifacts/eu/cyber-resilience-act/faq/items/page/14.md) | [15](/artifacts/eu/cyber-resilience-act/faq/items/page/15.md) | [16](/artifacts/eu/cyber-resilience-act/faq/items/page/16.md) | [17](/artifacts/eu/cyber-resilience-act/faq/items/page/17.md) | [18](/artifacts/eu/cyber-resilience-act/faq/items/page/18.md) | [19](/artifacts/eu/cyber-resilience-act/faq/items/page/19.md) | [20](/artifacts/eu/cyber-resilience-act/faq/items/page/20.md) | [21](/artifacts/eu/cyber-resilience-act/faq/items/page/21.md) | [22](/artifacts/eu/cyber-resilience-act/faq/items/page/22.md) | [23](/artifacts/eu/cyber-resilience-act/faq/items/page/23.md) | [24](/artifacts/eu/cyber-resilience-act/faq/items/page/24.md) | [25](/artifacts/eu/cyber-resilience-act/faq/items/page/25.md) | [26](/artifacts/eu/cyber-resilience-act/faq/items/page/26.md) | [27](/artifacts/eu/cyber-resilience-act/faq/items/page/27.md) | [28](/artifacts/eu/cyber-resilience-act/faq/items/page/28.md) | [29](/artifacts/eu/cyber-resilience-act/faq/items/page/29.md) | [30](/artifacts/eu/cyber-resilience-act/faq/items/page/30.md) | [31](/artifacts/eu/cyber-resilience-act/faq/items/page/31.md) | [32](/artifacts/eu/cyber-resilience-act/faq/items/page/32.md) | [33](/artifacts/eu/cyber-resilience-act/faq/items/page/33.md) | [34](/artifacts/eu/cyber-resilience-act/faq/items/page/34.md) | [35](/artifacts/eu/cyber-resilience-act/faq/items/page/35.md) | [36](/artifacts/eu/cyber-resilience-act/faq/items/page/36.md) | [37](/artifacts/eu/cyber-resilience-act/faq/items/page/37.md) | [38](/artifacts/eu/cyber-resilience-act/faq/items/page/38.md) | [39](/artifacts/eu/cyber-resilience-act/faq/items/page/39.md) | [40](/artifacts/eu/cyber-resilience-act/faq/items/page/40.md) | [41](/artifacts/eu/cyber-resilience-act/faq/items/page/41.md) | [42](/artifacts/eu/cyber-resilience-act/faq/items/page/42.md) | [43](/artifacts/eu/cyber-resilience-act/faq/items/page/43.md) | [44](/artifacts/eu/cyber-resilience-act/faq/items/page/44.md) | [45](/artifacts/eu/cyber-resilience-act/faq/items/page/45.md) | [46](/artifacts/eu/cyber-resilience-act/faq/items/page/46.md) | [47](/artifacts/eu/cyber-resilience-act/faq/items/page/47.md) | [48](/artifacts/eu/cyber-resilience-act/faq/items/page/48.md) | [49](/artifacts/eu/cyber-resilience-act/faq/items/page/49.md) | [50](/artifacts/eu/cyber-resilience-act/faq/items/page/50.md) | [51](/artifacts/eu/cyber-resilience-act/faq/items/page/51.md) | [52](/artifacts/eu/cyber-resilience-act/faq/items/page/52.md) | [53](/artifacts/eu/cyber-resilience-act/faq/items/page/53.md) | [54](/artifacts/eu/cyber-resilience-act/faq/items/page/54.md) | [55](/artifacts/eu/cyber-resilience-act/faq/items/page/55.md) | [56](/artifacts/eu/cyber-resilience-act/faq/items/page/56.md) | [57](/artifacts/eu/cyber-resilience-act/faq/items/page/57.md) | [58](/artifacts/eu/cyber-resilience-act/faq/items/page/58.md) [Previous page](/artifacts/eu/cyber-resilience-act/faq/items/page/56.md) | [Next page](/artifacts/eu/cyber-resilience-act/faq/items/page/58.md) *Recommended next step* *Placement: after the FAQ summaries* ## Turn CRA FAQ answers into product evidence Use these CRA FAQ summaries to assign scope checks, role mapping, risk-assessment evidence, vulnerability-reporting intake, conformity-assessment records, CE marking controls, support-period rationale, and market-surveillance readiness tasks. - [Open Assessment Autopilot](/solutions/assessment.md): Convert CRA scope, role, support-period, and conformity questions into evidence requests and review tasks. - [Talk through CRA readiness](/contact.md): Review product boundaries, launch blockers, vulnerability-handling evidence, and market-access records with the Sorena team. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/57.md