EU Cyber Resilience Act FAQ Tailor-Made Products

The CRA does not create a broad general definition section for tailor-made products, but recital 64 and the Commission FAQ give the working test.

A tailor-made product is a product with digital elements fitted to a particular purpose for a particular business user, where the manufacturer and that business user have explicitly agreed different contractual terms.

Only two essential requirements are expressly subject to the tailor-made carve-out:

- secure-by-default configuration in Annex I Part I point (2)(b)

- free-of-charge dissemination of security updates in Annex I Part II point (8)

The carve-out does not remove the rest of the CRA.

No.

The manufacturer still has to comply with the CRA generally, including the cybersecurity risk assessment, technical documentation, conformity assessment, and the other applicable Annex I requirements. The tailor-made carve-out is limited to the two expressly identified requirements.

Not on the terms set out in recital 64 and Annex I.

The CRA carve-out is framed around a manufacturer and a business user agreeing different contractual terms. That makes this a business-user exception, not a consumer-product exception.

No.

A B2B product is not tailor-made merely because the customer is a business. The product must be fitted to a particular purpose for a particular business user, and the parties must explicitly agree different contractual terms.

No.

The Commission FAQ says a product is not tailor-made where it undergoes minor customisations before sale without specific contractual terms or arrangements. It gives examples such as CRM platforms sold to multiple businesses and platforms that allow customisation through plugins or APIs while remaining fundamentally the same product for every customer.

The Commission FAQ gives examples such as custom-developed hardware or software built for the needs of a specific business user, or products developed for integration into a specific customer's highly controlled environment, such as a closed or air-gapped environment, where specific contractual terms apply.

That does not create an automatic rule for all closed or industrial environments. The particular-purpose, particular-business-user, and explicit-contract criteria still have to be met.

No.

The Commission FAQ gives such environments only as examples of cases that may qualify where the product is developed for integration into a specific customer's environment and specific contractual terms apply. The environment by itself does not satisfy the CRA test.

Yes.

Recital 64 and the Commission FAQ both say the manufacturer and the business user must explicitly agree a different set of contractual terms.

Yes, but only because Annex I Part II point (8) allows deviation for tailor-made products where the manufacturer and a business user have otherwise agreed.

Without that explicit tailor-made agreement, security updates addressing identified security issues must be disseminated free of charge.

It can deviate from the secure-by-default requirement only within the tailor-made carve-out.

That means the deviation must be tied to the particular-purpose, particular-business-user, and explicit-contractual-terms conditions. It does not remove the manufacturer's broader obligation to place a compliant product on the market under the CRA.

The Commission FAQ says the manufacturer is expected to include in the technical documentation all relevant data or details showing compliance with the applicable essential requirements, including appropriate evidence that the product is tailor-made.

That means the documentation should support the particular-purpose, particular-business-user, and explicit-contractual-deviation elements.

Yes.

The CRA does not create a general Annex II exemption for tailor-made products. Manufacturers still need to comply with Article 13(18) and provide the required information and instructions to the user, unless a specific CRA provision says otherwise.

No.

The tailor-made carve-out does not remove the CRA's general vulnerability-handling regime. It only allows deviation from the free-of-charge element of Annex I Part II point (8) where the tailor-made conditions are met. The manufacturer still remains subject to the broader CRA obligations, including handling vulnerabilities during the support period.

Yes.

Annex I Part II point (8) still requires security updates to be disseminated without delay and accompanied by advisory messages with the relevant information, including potential action users should take. The tailor-made exception changes the free-of-charge requirement where otherwise agreed, but it does not remove those other parts of point (8).

No.

Inference from the CRA text and the Commission FAQ: the material requires more than the existence of a commercial contract. The product must be fitted to a particular purpose for a particular business user, and the parties must explicitly agree a different set of contractual terms. The FAQ's negative examples show that ordinary multi-customer business products with only minor customisation do not become tailor-made on that basis alone.

No, not on that fact alone.

Inference from the Commission FAQ: where the product remains fundamentally the same product for every customer, the tailor-made exception does not apply merely because each customer has its own configuration, plugin set, API use, or minor pre-sale customisation. The CRA materials point the other way unless the product is genuinely fitted to a particular purpose for a particular business user under explicit different contractual terms.