CRA implementation guidance

Commission Guidance on the application of the Cyber Resilience Act (CRA) — C(2026) 5252

The guidance clarifies scope questions under the Cyber Resilience Act, including how remote data processing solutions and free and open source software fall within its requirements. It defines what constitutes a "substantial modification" of a product, explains how support periods should be understood and applied, and sets out how manufacturers meet reporting obligations and risk assessment requirements. It includes 67 practical examples, use cases, flowcharts, and graphs, with particular attention to proportionate compliance paths for microenterprises and SMEs.