European Commission Publishes FAQ on the Cyber Resilience Act
The European Commission has published a document with answers to frequently asked questions on the Cyber Resilience Act. On 66 pages, it answers central questions about implementing the regulation. It is the Commission's first official guidance on the practical application of the CRA.
Contents
Background
The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, entered into force on December 10, 2024. It sets cybersecurity requirements for products with digital elements made available on the EU market. Since its entry into force, manufacturers, importers, and other economic operators have needed considerable clarification on how to implement it in practice.
The document now published offers initial guidance. The Commission explicitly stresses three points:
- It is a “living document” that will be updated as necessary.
- The answers are not a binding legal interpretation.
- Further official guidance under Article 26 of the CRA was to follow. The Commission published it on July 27, 2026 (Commission guidance on CRA implementation).
Structure and scope
The document is organized into seven main chapters:
- Scope (9 questions): Which products fall under the CRA, and which are excluded?
- Interplay with other legislation (17 questions): relationship to the Machinery Regulation, the General Data Protection Regulation (GDPR), product safety rules, the Radio Equipment Directive, and other EU legislation
- Important and critical products (4 questions): classification and its consequences
- Manufacturer's obligations (29 questions): risk assessment, essential requirements, vulnerability handling, due diligence, support periods
- Reporting obligations (4 questions): requirements for reporting vulnerabilities and incidents
- Conformity assessment (10 questions): modules A, B+C, and H, technical documentation, CE marking
- Transition period (5 questions): dates of application and treatment of existing products
Selected clarifications
The document contains many clarifications that matter in practice. Some examples:
- Scope: The Commission gives concrete examples of products that are not covered by the CRA. They include a dishwasher with embedded firmware but no capability to connect to other devices, and an electric toothbrush with a wireless charging station but no data connectivity.
- Manufacturer obligations: Manufacturers do not necessarily have to patch every vulnerability they discover. They decide based on risk. The Commission uses examples to explain when different remedies can be appropriate, from immediate patches and workarounds to documentation updates.
- Components: Manufacturers may also integrate components without CE marking, such as open-source components. What matters is that they exercise appropriate due diligence. How far this must go depends on the risk of the component.
- Support period: The minimum support period of five years is not absolute. For products expected to be in use for a shorter time, the support period can be correspondingly shorter. Where longer use is expected, manufacturers must provide longer support periods.
- Transition period: The CRA applies to individual products, not to product types. A product type developed before the cut-off date may not comply with the CRA. In that case, it cannot simply continue to be manufactured and placed on the market after December 11, 2027.
What the FAQ means in practice
The document answers many questions that industry has put to the Commission in recent months. It gives manufacturers concrete guidance as they prepare for mandatory CRA compliance from December 11, 2027.
The many practical examples are particularly helpful, because they make the abstract requirements of the regulation concrete. The document does not replace an individual legal assessment, however, especially for complex products or constellations.
Next step: find out where you stand
The published FAQs give you orientation, but where do you stand in practice? Our free readiness check shows you in a few minutes how well your products and processes are prepared for the CRA.
Assessment
The document gives manufacturers official guidance on interpreting the CRA requirements for the first time. Its treatment of borderline cases, its clarifications on overlaps with other legislation, and its many practical examples are particularly useful. They show that the Commission takes a pragmatic approach.
The document deliberately stays general, however. The Commission repeatedly points out that manufacturers must decide on the basis of their own risk assessment, and it stresses that this first guidance is preliminary. The guidance under Article 26 that was announced at the time has been available since July 27, 2026. Manufacturers should therefore treat the document as a first important building block for their CRA compliance, not as a complete manual.
Further reading:
