Key Terms
- Product with digital elements
- Any software or hardware product and its remote data processing solutions, including components placed on the market separately, that has a direct or indirect data connection to a device or network [Art. 3(1)].
- Software bill of materials (SBOM)
- A formal, machine-readable record detailing the components and supply chain relationships within the software elements of a product with digital elements [Art. 3(39)].
- Actively exploited vulnerability
- A vulnerability for which reliable evidence exists that a malicious actor has exploited it in a system without the system owner's permission [Art. 3(42)].
- Support period
- The time during which a manufacturer must ensure effective vulnerability handling in accordance with Annex I Part II — at least five years unless the expected product lifetime is shorter [Art. 3(20), Art. 13(8)].
- Open-source software steward
- A legal person, other than a manufacturer, that systematically provides sustained support for the development of specific free and open-source products intended for commercial activities [Art. 3(14)].
- Substantial modification
- A change to a product with digital elements after its placing on the market that affects compliance with the essential cybersecurity requirements in Annex I Part I, or that changes the product's intended purpose [Art. 3(30)].
- Conformity assessment
- The process of verifying whether the essential cybersecurity requirements set out in Annex I have been fulfilled, carried out through self-assessment or third-party evaluation depending on the product category [Art. 3(27), Art. 32].
?
Frequently Asked Questions
Does the CRA apply to pure SaaS products?
The CRA applies to products with digital elements, defined as software or hardware and their remote data processing solutions [Art. 3(1)]. Pure SaaS that does not form part of a product with digital elements falls outside the CRA's scope. However, if the SaaS component is a 'remote data processing solution' without which the product cannot perform one of its functions, it is covered [Art. 3(2)].
Are open-source projects affected?
Free and open-source software made available outside the course of a commercial activity is not subject to manufacturer obligations [Recital 18]. However, 'open-source software stewards' — legal persons systematically supporting commercial open-source products — must put in place cybersecurity and vulnerability handling policies, though they are exempt from administrative fines [Art. 25, Art. 64(10)(b)].
What qualifies as an 'important' or 'critical' product?
Important products are listed in Annex III across two classes: Class I includes items such as identity management systems, browsers, VPNs, operating systems, and routers; Class II includes hypervisors, firewalls, and tamper-resistant microprocessors [Art. 7]. Critical products (Annex IV) include hardware security boxes, smart meter gateways, and smartcards [Art. 8]. Classification determines the applicable conformity assessment route.
What are the reporting deadlines for actively exploited vulnerabilities?
Manufacturers must submit an early-warning notification within 24 hours, a detailed vulnerability notification within 72 hours, and a final report within 14 days after a corrective measure is available [Art. 14(2)]. For severe incidents, the final report is due within one month of the incident notification [Art. 14(4)(c)]. All reports go through ENISA's single reporting platform [Art. 16].
How long must security updates be provided?
Manufacturers must handle vulnerabilities for the entire support period, which must be at least five years unless the product's expected use time is shorter [Art. 13(8)]. Each security update must remain available for at least 10 years or the remainder of the support period, whichever is longer [Art. 13(9)].
What happens to products already on the market when the CRA applies?
Products placed on the market before 11 December 2027 only become subject to CRA requirements if they undergo a substantial modification after that date [Art. 69(2)]. However, the vulnerability and incident reporting obligations under Art. 14 apply to all in-scope products already on the market, regardless of modification [Art. 69(3)].
Is a software bill of materials (SBOM) mandatory to share with customers?
Manufacturers must generate an SBOM covering at minimum the top-level dependencies of the product [Annex I, Part II(1)]. The SBOM must be included in the technical documentation but does not have to be shared with end-users — sharing is optional, though the manufacturer must inform users where to access it if they choose to make it available [Annex II, point 9].
3
Assessment Factors & Checklist
Premium4
Questions for Your Lawyer
Premium5
Conclusion & Summary
PremiumDetailed analysis with source links.
Schalten Sie die KI-Analyse frei — mit markierten Fundstellen und direkten Links zu EUR-Lex. 7 Tage kostenlos testen.
Keine Kreditkarte heute. Kündigung jederzeit.