With the Cyber Resilience Act (CRA), the European Union has, for the first time, established a comprehensive set of rules governing cybersecurity requirements for products containing digital elements. Even though the regulation will not become fully applicable until December 2027, businesses should not put off addressing these new requirements. The implementation will, in some cases, require far-reaching changes to product development, supply chains, documentation and vulnerability management – processes which, experience has shown, require considerable lead times. At EU level, intensive preparations are already in progress and the requirements are being concrete. The European Commission has recently published its first guidance on the CRA, supplementing the FAQs it published in December 2025. Our DORDA CRA experts have summarised some key takeaways from this guidance for you:
Clarifications regarding the product definition
The CRA leaves out a key legal definition – that of the product. The guidance now addresses this issue in part: it clarifies that software which serves to control, operate or configure hardware, or which is necessary for its proper use, forms part of the overall (hardware) product. This applies even if it is sourced separately (e.g. as a user's own download). Furthermore, both machine code and source code may constitute software within the meaning of the CRA – a broader interpretation that differs from that of the Product Liability Directive.
Placing on the market and making available
Furthermore, one of the fundamental conditions for the applicability of the CRA is that the product is placed on the market or made available in the supply chain within the Union market. With regard to traditionally networked hardware, the Commission focuses on the supply of the individual product (unit). In the case of standalone software made available digitally, what is relevant is the initial provision for distribution or use on the EU market. It is therefore irrelevant if a customer does not download the software until a later date. Later versions only constitute a new placing on the market – and consequently trigger the manufacturer’s obligations – if they involve a fundamental change.
Open-Source-Software (OSS)
There are special provisions for OSS software that is either distributed under the FOSS licence or whose source code is made publicly available:
- If OSS is monetised on the market (e.g. through payment or data), the provider is generally regarded as the producer and is subject to a wide range of obligations.
- If, on the other hand, there is no market-oriented provision, classification as an “open-source software manager” may be considered: these actors systematically and sustainably promote the development of OSS for commercial activities without being manufacturers themselves. They are subject only to limited documentation and reporting obligations. The provisions on penalties do not apply to them.
- Manufacturers who integrate OSS components into their products remain responsible for cyber security. This is the case regardless of whether the OSS itself falls directly under the CRA. As a component, the OSS is subject to the due diligence obligations of the manufacturer of the end product. In practice, this involves major challenges. To support the conformity assessment, the Commission is planning voluntary programmes for the certification of the cybersecurity of such OSS components.
Significant changes
If a trader or importer makes a significant change to a purchased product, they may be reclassified as a manufacturer – with all the resulting additional compliance requirements. This guidance sets out in more detail when such a change takes place. In the case of software updates, for example, the key factor is whether the risk assessment changes as a result – for instance, due to newly created attack vectors. This always requires a case-by-case assessment.
Your DORDA cybersecurity experts will keep you up to date with further developments and will be happy to support you with your CRA implementation project.