Chapter I - GENERAL PROVISIONS
4

Article 4

Free movement

Regulation (EU) 2024/2847 — published 10 December 2024 · Last reviewed by Kunnus: March 2026

(1)

Member States shall not impede, for the matters covered by this Regulation, the making available on the market of products with digital elements which comply with this Regulation.

(2)

At trade fairs, exhibitions, demonstrations or similar events, Member States shall not prevent the presentation or use of a product with digital elements which does not comply with this Regulation, including its prototypes, provided that the product is presented with a visible sign clearly indicating that it does not comply with this Regulation and that it is not to be made available on the market until it does so.

(3)

Member States shall not prevent the making available on the market of unfinished software which does not comply with this Regulation, provided that the software is made available only for a limited period required for testing purposes with a visible sign clearly indicating that it does not comply with this Regulation and that it will not be available on the market for purposes other than testing.

(4)

Paragraph 3 does not apply to safety components as referred to in Union harmonisation legislation other than this Regulation.

European Commission Interpretation

Guidance of 27 July 2026

The EU Commission guidance of 27 July 2026 provides official interpretation notes on this provision. Each section: summary, key takeaways, and what it means for you in practice.

Section 2.3Computer code — source code and machine code

Both machine code and source code are 'software' within the meaning of Article 3(4). What matters is whether the supply occurs in the course of a commercial activity: openly shared FOSS code, unfinished code during development, and demo or tutorial code are not considered placed on the market — source code licensed commercially to customers is.

Key takeaways

  • Supplying source code to customers as a product places it on the market — even where the customer must adapt and compile it first (Example 7).
  • The licensor is not responsible for CRA compliance of the customer's downstream adaptations.
  • Unfinished software (alpha, beta, release candidates) may be made available under Article 4(3) for the time necessary for testing and feedback.

In practice

Review your licence and supply contracts: where do you provide customers with source code for remuneration? You bear full manufacturer obligations for that code — but not for what the customer builds from it. Demo code, tutorials and beta versions for testing remain out of scope.

Section in the guidance overview
Browse all guidance chapters

EU Commission Guidance (C(2026) 5252 final) — The guidance reflects the European Commission's interpretation and is not legally binding. An authoritative interpretation of the EU CRA may only be given by the Court of Justice of the European Union.

Related Recitals

(1)

CRA updates by email

Deadlines, official guidance, and myth-busting fact-checks on the Cyber Resilience Act — compact in our newsletter.

View newsletters

This text is reproduced from Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024. It is provided for informational purposes only and does not constitute legal advice. Only the text published in the Official Journal of the European Union is legally binding. Original text on EUR-Lex