European Commission Publishes Guidance on the CRA
On July 27, 2026, the European Commission published its guidance on applying the Cyber Resilience Act (C(2026) 5252). It is aimed at manufacturers and other economic operators who need to know how the Commission reads the CRA.
What is the Commission's CRA guidance?
The Commission's CRA guidance is an interpretive aid to Regulation (EU) 2024/2847, published on July 27, 2026. It explains the scope, substantial modification, and the support period, and it contains 67 examples. It is not legally binding. Only the Court of Justice of the European Union can give a binding interpretation of the CRA.
What does the guidance cover?
Article 26 of the CRA sets out the minimum content of the guidance. Accordingly, the guidance covers:
- the scope, in particular remote data processing and free and open-source software
- the concept of substantial modification, including software updates and spare parts
- how to determine the support period
- risk assessment, reporting obligations, and the interplay with other Union law
It also clarifies the concept of core functionality. Together with Implementing Regulation (EU) 2025/2392, core functionality decides which conformity assessment procedure applies to a product.
For machinery and plant manufacturers, the passages on existing product lines matter most. Products developed before December 11, 2027 and placed on the market after that date do not have to be redesigned if the risk assessment shows that appropriate measures are in place.
What should you know about its status?
Formally, the Commission has so far only approved the content of the draft. Formal adoption follows once all language versions are available. Only from that point does the guidance apply. If you cite it in test or approval documents, you should be aware of this difference.
Where can you find the documents?
The Communication C(2026) 5252 and the annex with the draft guidance are available for download on the European Commission's publication page. There you will also find the details on each topic, with examples and decision trees.
How far along is your product with the CRA?
The guidance explains scope, product classes, and manufacturer obligations in general terms. The free readiness check applies this to your product and shows in a few minutes which obligations apply and where the biggest gaps are.
