European Commission provides long-awaited clarity for the Cyber Resilience Act
The European Commission has published official guidelines for the application of the Cyber Resilience Act (CRA), helping manufacturers, suppliers, and open-source projects better understand how the law should be applied in practice. The guidance clarifies when software, hardware, and combinations thereof fall under the CRA and when software is considered to be “placed on the market.”
It also provides an in-depth look at the position of open-source software, maintainers, and open-source stewards, including when commercial activities trigger CRA obligations. Additionally, the Commission clarifies the concept of “substantial modification” and its consequences for conformity assessments and CE marking. Extra attention is given to complex systems, software updates, and products developed before the CRA but placed on the market at a later date.
The guidance describes how cybersecurity risk assessments should be conducted and how dependencies on external components must be taken into account. Remote data processing, cloud functionalities, and the relationship between software and online services are also further defined. Furthermore, the document addresses the support period, vulnerability management, and reporting obligations throughout the entire lifecycle of digital products.
The guidelines are not legally binding, but they do provide the official interpretation of the European Commission and will play a significant role in supervision and enforcement. For organisations developing software or connected products, this guidance will be an essential tool for becoming CRA-compliant in a timely manner.