EU Cyber Resilience Act FAQ Repairs and Spare Parts

No.

The CRA says those operations do not necessarily lead to a substantial modification. The real question is whether the change affects compliance with the essential cybersecurity requirements or changes the intended purpose for which the product was assessed. Recital 42 also makes clear that a manufacturer-led "upgrade" can still become substantial if it changes the product's design and development in a way that affects intended purpose or compliance.

Case by case.

The draft guidance says refurbishment, maintenance, or repair that physically changes a product does not automatically become a substantial modification. The assessment should ask whether the physical change affects compliance with Annex I Part I or changes the intended purpose covered by the cybersecurity risk assessment.

No.

The draft guidance says replacing defective or worn parts with parts that perform better does not in itself trigger substantial modification. It only does so if the change affects compliance with the essential requirements or changes the intended purpose in a way not covered by the original risk assessment.

Yes.

Article 2(6) excludes spare parts made available to replace identical components, where they are manufactured according to the same specifications as the components they replace.

Yes.

Recital 29 and the draft guidance both say the exemption covers spare parts for legacy products placed on the market before the CRA applies, as well as spare parts for products that have already gone through CRA conformity assessment.

Then the spare part is itself subject to the CRA as a product in its own right.

The draft guidance says compliance must then be assessed in light of that spare part's intended purpose, including its role in ensuring compatibility or interoperability with the existing product.

No.

The draft guidance says the repair does not in itself amount to a substantial modification, provided the repaired product's intended purpose and cybersecurity risk profile remain unchanged.

The manufacturer must reflect those constraints in the cybersecurity risk assessment and implement appropriate alternative or compensatory risk-mitigation measures.

The draft guidance also says the technical documentation and user information should transparently describe the constraints, the associated risks, and the measures taken.

Yes, often.

The CRA says security updates that are designed to reduce cybersecurity risk and that do not modify the intended purpose are generally not substantial modifications. The Commission FAQ gives the example of a bug-fix update for a pre-CRA smart TV that does not bring the product into CRA compliance because it does not substantially modify it.

When it changes the intended purpose or introduces new or increased cybersecurity risks not covered by the original risk assessment.

The CRA recital and the draft guidance both make clear that the label "security update" is not decisive by itself. A software change can still qualify as substantial modification if it materially changes the product's trust model, dependencies, data flows, or risk profile.

The modified product is treated as a new product for CRA purposes.

That means the act of making the substantially modified product available on the market becomes a new placing on the market. The person carrying out the substantial modification may become the manufacturer under Article 21 or Article 22. Under Article 22(2), the CRA obligations apply to the affected part of the product, or to the whole product if the modification impacts the cybersecurity of the product as a whole.

No.

The draft guidance says existing documentation and tests may be reused for aspects not impacted by the substantial modification. The conformity assessment should focus on the substantially modified parts.

For those products, the CRA generally applies only if, from 11 December 2027 onward, they are substantially modified.

The Commission FAQ says a non-substantial bug-fix update on a legacy product does not trigger CRA compliance for that product. But Article 14 reporting obligations apply more broadly even to products placed on the market before 11 December 2027.

No, not unless they carry out a substantial modification.

The Commission FAQ says distributors are not required to bring products placed on the market before 11 December 2027 into CRA compliance merely because they continue making them available after that date. That changes only if they themselves carry out a substantial modification.

It exempts the spare part itself.

Whether the repair amounts to a substantial modification is a separate question. The draft guidance's spare-part examples show that an identical-specification replacement usually does not amount to a substantial modification, but that conclusion still rests on the repair analysis rather than on Article 2(6) alone.

No.

For the Article 2(6) exemption, the part must replace an identical component and be manufactured according to the same specifications. The draft guidance's Example 34 shows the opposite case: a replacement module may preserve the same function, communication protocols, and security mechanisms, yet still fall outside the exemption if it is based on a different chipset or updated firmware.

No.

The Blue Guide says repaired products that are not considered new products do not need to undergo conformity assessment again, whether the original product was placed on the market before or after the legislation entered into force. It says that remains true even if the product was temporarily exported to a third country for the repair operation. Under the CRA, the key issue remains whether the repair is substantial.

Not automatically.

The draft guidance says the manufacturer must document the constraints, assess the associated risks, and implement compensatory measures. It also says such constraints should be periodically reassessed during the support period, and where they can be reduced or lifted over time, the product should be updated so it can move towards state-of-the-art cybersecurity.