Cyber Resilience Act: Guidance for manufacturers of products with digital elements

Here, the guidance refers to the Blue Guide and also clarifies that the terms ‘placing on the market’ and ‘making available’ are to be understood as referring ‘to each individual product’ and not to a product type, regardless of whether it was manufactured as a single item or in series.

For standalone software that is made available digitally, the terms within the meaning of Regulation (EU) 2024/2847 are considered to have been placed on the market as soon as its development is complete and it is offered for the first time within the framework of a commercial activity for distribution or use on the EU market.

Since digital software can be reproduced without physical production or storage limits, this initial offer means that a virtually unlimited number of identical copies are considered to be placed on the market simultaneously. Subsequent downloads or accesses are merely considered to be the provision of the same product already placed on the market, even if they occur at different times.

New versions of the software are only considered to be placed on the market again if they constitute a substantial modification. Minor updates or iterations without substantial modification do not require a new conformity assessment and do not change the original date of placing on the market.

This interpretation applies only to standalone software that is digitally provided. It does not apply if:

• Software is delivered on physical data carriers (e.g. USB stick) or
• Software is distributed together with hardware as a product.
   

Regulation (EU) 2024/2847 applies to products with digital elements, i.e. hardware or software products and their remote processing solutions, provided they have a direct or indirect data connection to devices or networks.

The scope of application includes, among other things:

• Standalone software (e.g. apps or computer programmes)
• Hardware with embedded software (e.g. IoT devices)
• Standalone hardware (e.g. chips or motherboards)
• Combinations of hardware and software, even if they are provided separately

The decisive factor is not how or when software is provided, but whether it is necessary for the intended functions of the product. If a hardware device can only perform its functions in conjunction with specific software, the hardware and software are jointly considered a single product with digital elements.

This also applies if the software is only provided after the hardware has been sold through other channels (e.g. website, app store, download). Examples include device drivers for printers or apps for controlling a fitness tracker, which are necessary for the operation or use of the device.

Regulation (EU) 2024/2847 applies to products with digital elements if their intended or foreseeable purpose involves a direct or indirect data connection to a device or network.

The definition of the term ‘product with digital elements’ is ultimately based on the definition of the term ‘electronic information system’, i.e. ‘a system, including electrical or electronic equipment, capable of processing, storing or transmitting digital data’ (Article 3(7), CRA). The scope of the CRA is therefore not linked to the mere presence of electronics, but to the ability of a product to exchange digital information.

A data connection within the meaning of the CRA only exists if information can be deliberately digitally encoded (e.g. in binary form) and sent and interpreted as data by a recipient. Pure electrical signals that merely trigger a function (e.g. on/off signals without information transmission) are not considered data connections and therefore do not fall under this aspect of the CRA's scope.
 

Regulation (EU) 2024/2847 also applies to ‘complex systems’ consisting of multiple hardware and software components if they are provided on the market as a single product.

Such systems may be difficult to adapt to new security requirements due to long development cycles, existing architectures or necessary interoperability. Nevertheless, they do not automatically fall outside the scope of the CRA. Instead, a risk-based approach applies.

Manufacturers must:

• perform a cybersecurity risk assessment,
• identify and document technical limitations,
• implement alternative or compensating security measures if certain requirements cannot be fully met.

These limitations, risks and measures must be described transparently in the technical documentation and user information and reviewed regularly during the support period and updated if necessary.

Products that were developed before the application of Regulation (EU) 2024/2847 may continue to be placed on the market without requiring redevelopment.

This is subject to the manufacturer:

• performs a cybersecurity risk assessment,
• demonstrates that the product already incorporates appropriate and effective security measures,
• and thus meets the essential cybersecurity requirements.

However, even without design changes, all CRA obligations must be complied with, in particular:

• Performing a conformity assessment,
• drawing up the EU declaration of conformity,
• affixing the CE marking,
• documentation and risk assessment, and technical files.

If no original security assessment from the development phase is available, the manufacturer must prepare a current risk assessment and document how existing measures mitigate the identified risks. In addition, processes for dealing with vulnerabilities must be established and the risk assessment must be updated regularly during the support period.

Regulation (EU) 2024/ 2847 Article 3(30) defines a ‘substantial modification’ as a change to the product with digital elements after it has been placed on the market that affects the product's compliance with the essential cybersecurity requirements in Annex I, Part I, or leads to a change in the intended purpose for which the product was manufactured.

According to the CRA, any person or company is considered a manufacturer if they make a substantial modification to a product and subsequently make it available on the market.

This applies in particular to:

• importers or distributors who substantially modify a product,
• any other natural or legal person who makes such a modification,
• modifications to products placed on the market before 11 December 2027 if they are subsequently substantially modified.

Regulation (EU) 2024/2847 distinguishes between ‘modifications’, “repairs”, ‘replacement parts’ and ‘software updates’ in order to determine whether a substantial modification to a product has been made.

Physical changes/repairs

Maintenance, repair or replacement of components does not automatically result in a substantial modification. The decisive factor is whether:

• the intended use of the product changes or
• the cybersecurity risk increases.

The replacement of defective parts with equivalent or better components is not generally considered a substantial modification as long as the function and risk remain unchanged.

Spare parts

• Identical spare parts manufactured to the same specifications are not covered by the CRA.
• Non-identical spare parts are considered separate products and are subject to the CRA.

Nevertheless, their installation does not normally constitute a substantial modification of the original product if the purpose and risk profile remain the same.

Software updates

A software update is considered a substantial modification if it:

• affects compliance with cybersecurity requirements or
• changes the original intended use of the product or
• introduces new or increased cybersecurity risks that were not considered in the original risk assessment.

Normal security updates or updates that were already included in the original risk assessment are generally not considered a significant change.

If a significant change is made:

• the product is considered to be newly placed on the market,
• the natural or legal person making the change is considered to be the manufacturer,
• a new conformity assessment according to CRA is required

With regard to documentation following a significant change, reference is made to section 2.1 of the Blue Guide. This clarifies that the technical documentation must be updated if the change has an impact on the requirements of the applicable legislation. It is not necessary to repeat tests and create new documentation relating to aspects that are not affected by the change. It is the responsibility of the natural or legal person who makes or has made changes to the product to demonstrate that not all elements of the technical documentation need to be updated. The natural or legal person who makes or has made changes to the product is responsible for the conformity of the changed product and must issue a declaration of conformity, even if they use existing tests and technical files.

Products that were made available on the market before 11 December 2027 will only be covered by the CRA if they are substantially modified after that date.