In order to ensure that products with digital elements made available on the market can be repaired effectively and their durability extended, an exemption should be provided for spare parts. That exemption should cover both spare parts that have the purpose of repairing legacy products made available before the date of application of this Regulation and spare parts that have already undergone a conformity assessment procedure pursuant to this Regulation.
29
Recital 29
Regulation (EU) 2024/2847 — published 10 December 2024 · Last reviewed by Kunnus: March 2026
European Commission Interpretation
Guidance of 27 July 2026The EU Commission guidance of 27 July 2026 provides official interpretation notes on this provision. Each section: summary, key takeaways, and what it means for you in practice.
Section 4.1 – 4.2Physical repairs and spare parts
Repair, refurbishment and maintenance generally do not amount to a substantial modification as long as the intended purpose and level of risk remain unchanged. The spare-parts exemption (Art. 2(6)) applies only where the part is demonstrably supplied to repair an existing product; 'identical' is measured against security-relevant characteristics, not physical sameness.
Key takeaways
- Replacing a defective part with a better-performing one is not in itself a substantial modification (Example 35: faster RAM in a server).
- A new chipset using the same protocols and security mechanisms can be 'identical' (Example 38); a different cryptographic implementation or secure-boot mechanism cannot (Example 37).
- The repair purpose must be apparent from the supply context (product identified in the order/offer, after-sales channel) — keep supporting evidence for market surveillance.
- The exemption also covers replacing entire modules or sub-products within larger systems (Example 39: CPU unit or complete PLC).
In practice
For every spare part, document the repair context (product identified in the order/offer, supply via after-sales channel) and compare security-relevant characteristics — crypto, protocols, secure boot, access controls — rather than part numbers. Only then can you demonstrate the Art. 2(6) exemption to market surveillance.
Browse all guidance chapters
EU Commission Guidance (C(2026) 5252 final) — The guidance reflects the European Commission's interpretation and is not legally binding. An authoritative interpretation of the EU CRA may only be given by the Court of Justice of the European Union.
Related Articles
(1)This text is reproduced from Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024. It is provided for informational purposes only and does not constitute legal advice. Only the text published in the Official Journal of the European Union is legally binding. Original text on EUR-Lex