How do product modifications affect the applicability of the CRA? What about customizing of a standard product?
Answer:
The CRA differentiates between several forms of modifications, which affects the applicability of the CRA.
Customization of a standard product
Typically, customization is not considered a modification resulting in a new or modified product, nor does it affect the intended purpose; thus, it does not fall under the CRA itself.
Security update or minor functionality modification
A security update is designed to decrease the level of cybersecurity risk of a product with digital elements does not modify the intended purpose of a product with digital elements, it is not considered to be a substantial modification. A minor functionality update can include a visual enhancement or a new language to the user interface (cf. Recital 39).
Substantial modifications
The CRA only applies to products with digital elements that are placed on the market after 11 December 2027, unless a product is substantially modified after this date (cf. Art. 3 (30) CRA). The Blue Guide by the European Commission serves as a guideline when a substantial modification occurs:
Modification of the intended purpose (i.e. a substantial modification): the software update modifies the intended purpose of that product and those changes were not foreseen by the manufacturer in the initial risk assessment, or where the nature of the hazard has changed or the level of cybersecurity risk has in-creased because of the software update, and the updated version of the product is made available on the market (cf. Recital 39). The term “made available” refers to the point in time when a product is supplied for distribution, consumption or use (cf. Blue Guide).
On the other hand, where a feature update modifies the original intended functions or the type or performance of a product with digital elements and meets the above criteria, it should be considered to be a substantial modification (cf. Recital 39).
Most recent content update of this FAQ: September 2025
Next FAQ: Which special rules from the CRA apply to software that is released in new versions several times a year?
