Does the CRA apply to products that were placed on the market for the first time before December 11, 2027, but which are still offered by the manufacturer in an unmodified state after that date?

Scenario:

A company manufactures products with digital elements in series. Units of this product are continuously sold by the manufacturer before December 11, 2027 and are assigned product number P/N #123 and serial numbers beginning with S/N #123-001. These units do not need to comply with the CRA requirements.

The manufacturer continues to sell identical units of this product after December 11, 2027 and marks them with the same product number P/N #123 and subsequent serial numbers, for example S/N #123-234 after having sold the last unit S/N #123-233 before the December 11, 2027 deadline.

Question 1:

Does the term “product” in the CRA refer to a product model or to all individual units of a product?

Answer 1:

It can refer to both, as it depends on the context.

Whether a product model falls under the CRA depends on whether or not a product model was newly established or substantially modified after December 11, 2027. If a modified product model falls under the CRA, each individual unit of the product must be compliant.

Question 2:

Do individual units of a product model that was placed on the market before December 11, 2027 have to be compliant with the CRA when they are continued to be sold after December 11, 2027? In the above scenario, do serial number S/N #123-234 and higher have to comply with the CRA?

Answer 2:

No.

The scope of the CRA defines that it only “applies to products with digital elements made available on the market […]” (cf. Art. 2 (1) CRA). However, the transitional provision in Art. 69 (2) CRA states:

“Products with digital elements that have been placed on the market before 11 December 2027 shall be subject to the requirements set out in this Regulation only if, from that date, those products are subject to a substantial modification.”

Art. 3 (21) defines

“‘placing on the market’ means the first making available of a product with digital elements on the Union market;”

In the example provided, the product model remains unchanged and was placed on the market prior to December 11, 2027 (also see FAQ “What is the difference between ‘placing on the market’ and ‘making available on the market’ with regard to legacy products?”). Hence, the requirements of the CRA do not apply, even for units with serial number S/N #123-234 or higher of this product model that are sold by the manufacturer after December 11, 2027.

If product model P/N #123 undergoes a substantial modification (also see FAQ "How do product modifications affect the applicability of the CRA?“) after December 11, 2027, it is then subject to compliance with the CRA.

Question 3:

Does it make a difference if an individual unit of the product in the example that was sold by the manufacturer before December 11, 2027 (e.g. serial number S/N #123-111) is re-sold by a distributor December 11, 2027?

Answer 3:

Selling individual units of a product to a distributor constitutes “placing a product on the market” and is outside of the scope of the CRA if this occurred before December 11, 2027. The resale of these (unmodified) product units is not subject to the obligations of the CRA.

Question 4:

If a product is not required to be CRA compliant, even after December 11, 2027, does that mean that a manufacturer can sell an insecure product after this deadline without taking responsibility for it?

Answer 4:

While the Cyber Resilience Act (CRA) does not directly apply to these products, there are still general quality requirements in place, including cybersecurity requirements. These requirements are in accordance with the provisions of the warranty and are independent of the CRA, as outlined by the applicable law. Please note that additional requirements may apply, as agreed upon in the relevant contractual agreements.

Please note that other statutory requirements may apply (depending of the product type, e.g. DORA, Regulation 2022/2554).

Most recent content update of this FAQ: November 2025

Next FAQ: Does the CRA also comply to legacy products that are still supported by the manufacturer?