EU CYBER RESILIENCE ACT REGULATORY GUIDANCEREGULATION (EU) 2024/2847 • 76 STATUTORY QUESTIONS & ANSWERS

EU CRA FAQs

Technical Frequently Asked Questions and statutory interpretations on Regulation (EU) 2024/2847 (Cyber Resilience Act). Comprehensive reference of 76 statutory questions across scopes, definitions, economic operator obligations, and CE marking.

EC Policy Portal ↗

Showing 76 official EU guidance answers

Scope & Definitions

Scope criteria, definitions of products with digital elements (PDE), data connections, and exclusions.

9 Questions

Interplay with other EU Legislation

Interplay with NIS2, EU AI Act, Machinery Regulation, Product Liability, Medical Devices, and GPSR.

17 Questions

Classification of Products with Digital Elements

Classification criteria determining Default, Important (Class I / Class II), and Critical products.

4 Questions

Manufacturer Obligations & Risk Assessments

Essential cybersecurity requirements (Annex I), risk assessment, secure-by-default, and support periods.

27 Questions

Reporting Obligations for Active Exploits & Severe Incidents

Mandatory 24-hour reporting of actively exploited vulnerabilities and severe incidents to ENISA and CSIRTs.

4 Questions

Conformity Assessment, Modules & Technical Documentation

Conformity assessment routes: Module A (internal control), Module B+C, Module H, and Notified Bodies.

10 Questions

Transition Period & Application Timelines

Application deadlines (11 Sep 2026 for reporting, 11 Dec 2027 for full application) and pre-existing stock rules.

5 Questions

This Site Uses No Cookies

Eigenia does not set cookies. The only thing stored in your browser is one preference, saved in local storage, noting that you have seen this notice.

EU CRA FAQs

Scope & Definitions

When is a product with digital elements in scope of the Cyber Resilience Act?

What is a product with digital elements? Are stand-alone software or firmware products with digital elements?

What is a direct or indirect logical or physical data connection to a device or network?

Does the CRA apply to products with digital elements placed on the market before 11 December 2027?

Are products that are manufacturer only for one's own use in scope of the CRA?

Can manufacturers release non-compliant versions of software for testing?

Can manufacturers maintain publicly accessible software archives?

Are products meant to be used for national security or defence purposes excluded from the CRA?

Are there products with digital elements covered by other Union legislation that are exempted from the CRA?

Interplay with other EU Legislation

Are products falling within the scope of Regulation (EU) 2018/1139 also covered by the CRA?

Are products falling within the scope of Directive (EU) 201 4/90 also covered by the CRA?

What is the interplay between the CRA and the Product Liability Directive?

What is the interplay between the CRA and the Machinery Regulation?

Should a product comply with both the CRA and MR cybersecurity requirements?

Should a manufacturer ensure the assessment of conformity for a product through the procedures set out in both the CRA and the MR?

What is the interplay between the CRA and the General Product Safety Regulation?

Does a product with digital elements need to comply with the requirements of both the CRA and the GPSR?

What is the interplay between the CRA and the Radio Equipment Directive?

What is the interplay between the CRA and the European Health Data Space Regulation?

Should a product comply with both the CRA and EHDS Regulation requirements?

Should a manufacturer ensure the assessment of conformity for a product through the procedures set out in both the CRA and EHDS Regulation?

Should the manufacturer draw up separate EU declarations of conformity per Union legal act?

What is the interplay between the CRA and the General Data Protection Regulation?

What is the interplay between the CRA and the Data Act?

How do the requirements for products with digital elements under the CRA take account of the obligations to make data available to users or third parties under the Data Act?

Should a manufacturer redesign their products to comply with the requirements of the DA and the CRA?

Classification of Products with Digital Elements

What determines if a product with digital elements is an important or critical product?

Does integrating an important or critical product with digital elements into another product with digital elements render that product important or critical?

Does the classification of a product as important or critical impact the manufacturer's risk assessment?

Does the presence of multiple functions mean that a product does not have the core functionality of an important or critical product?

Manufacturer Obligations & Risk Assessments

What does the CRA require of the manufacturer's cybersecurity risk assessment?

Does the CRA mandate a specific risk assessment methodology?

Does a manufacturer need to implement all the essential requirements?

What are intended purpose and reasonably foreseeable use, and how do they affect the cybersecurity risk assessment?

What is reasonably foreseeable misuse, and how does it affect the cybersecurity risk assessment?

How does the length of time the product is expected to be in use affect the manufacturer's cybersecurity risk assessment?

What is the relationship between harmonised standards and the manufacturer's cybersecurity risk assessment?

What does a manufacturer need to include regarding the cybersecurity risk assessment in the technical documentation to be kept at the disposal of market surveillance authorities?

Which technical measures does a manufacturer need to implement?

How can a manufacturer ensure that a product is free from all vulnerabilities?

How should manufacturers deal with known exploitable vulnerabilities discovered after a product has been placed on the market but before reaching its final user?

How does the secure-by-default requirement work?

When is a product "tailor-made"? What documentation is required in these cases?

Are manufacturers required to patch all vulnerabilities that are discovered during the support period?

Does the manufacturer need to address and remediate vulnerabilities for all versions of a software product?

Is the manufacturer responsible for the installation of security updates by the product's users?

Does the manufacturer need to recall the product if it cannot fix a vulnerability?

How should manufacturers ensure a separation between security and functionality updates, particularly where updates serve both purposes?

How should vulnerabilities in integrated components be addressed and remediated?

How does the end of the support period in an integrated component impact a product's compliance with the CRA?

What does the CRA prescribe when integrating components?

What is the appropriate level of due diligence?

In order to exercise due diligence, should a manufacturer only integrate components that bear the CE marking?

How should manufacturers exercise due diligence with regards to open-source components that are not subject to the CRA?

Which criteria should the manufacturer take into account when determining a product's support period?

Is there a minimum support period?

Can a manufacturer continue to sell products without a support period?

Reporting Obligations for Active Exploits & Severe Incidents

How can a manufacturer become aware of an actively exploited vulnerability or a severe incident?

Does a manufacturer need to report zero-day vulnerabilities?

Does a manufacturer need to report actively exploited vulnerabilities or severe incidents for products placed on the market before the CRA applies?

If an actively exploited vulnerability is contained in a third -party component, are all manufacturers integrating that component required to notify it?

Conformity Assessment, Modules & Technical Documentation

What is module A? How does it work? What conformity assessment activities are expected for self-assessment?

What is module B+C? How does it work?

What is module H? How does it work?

Are manufacturers required to ensure the conformity of "existing" product types?

Which evaluation methodology should a manufacturer apply?

What is the technical documentation?

What is the CE marking?

What is the declaration of conformity?

What are notified bodies?

When will harmonised standards to support CRA compliance be ready?

Transition Period & Application Timelines

When does the CRA start applying?