In line with the commonly established concept of substantial modification for products regulated by Union harmonisation legislation, where a substantial modification occurs that may affect the compliance of a product with digital elements with this Regulation or when the intended purpose of that product changes, it is appropriate that the compliance of the product with digital elements is verified and that, where applicable, it undergoes a new conformity assessment. Where applicable, if the manufacturer undertakes a conformity assessment involving a third party, a change that might lead to a substantial modification should be notified to the third party.
41
Recital 41
Regulation (EU) 2024/2847 — published 10 December 2024 · Last reviewed by Kunnus: March 2026
European Commission Interpretation
Guidance of 27 July 2026The EU Commission guidance of 27 July 2026 provides official interpretation notes on this provision. Each section: summary, key takeaways, and what it means for you in practice.
Section 2.1Placing standalone software on the market
Standalone software is placed on the market once its manufacturing phase is complete and it is first offered for distribution or use on the EU market. All copies of the same version are considered placed on the market at the same time — regardless of when individual users download them.
Key takeaways
- The moment of first offering counts for all copies of a version — later downloads are merely instances of 'making available' the same products.
- Iterations that are not substantial modifications do not shift the date of placing on the market; only a substantial modification counts as a new placing on the market (see Chapter 4 of the guidance).
- Variants that differ in included components, configurations or enabled functionalities (e.g. builds per operating system, differing feature bundles) are distinct products.
Example from the guidance
Version 1.0.0 is first offered via the website on 1 January 2028. Customer 1 buys the same day, customer 2 on 15 January. Both copies are considered placed on the market on 1 January 2028 (Example 1 of the guidance).
In practice
Record the date each software version is first offered — it determines when CRA obligations start for all copies of that version. Also keep a list of your variants (builds per operating system, feature bundles): each variant is a separate product with its own date.
Section 4.4Consequences of a substantial modification
A substantially modified product made available on the market counts as newly placed on the market. A third party carrying out a substantial modification becomes the manufacturer (Arts. 21/22) — but only for the modified part where the modification does not affect the product's cybersecurity as a whole. The original manufacturer may reuse documentation and tests for unchanged parts.
Key takeaways
- Distinguish integration: assembling components into a new product of one's own makes the integrator a regular manufacturer of the whole product — not a substantial modifier of others' products (Example 51).
- Legacy products: a substantial modification after 11 December 2027 of a product placed on the market before that date makes the modifier its manufacturer (Art. 69(2)) — with obligations limited to the modified parts as long as the product's overall cybersecurity is unaffected.
- The original manufacturer's obligations for the original product (vulnerability handling, compliance of unchanged parts) continue to apply.
- Conformity assessment focuses on the modified parts; existing tests and documentation may be reused for unchanged parts.
In practice
Separate two cases cleanly: if you substantially modify someone else's marketed product, you take on manufacturer obligations — but only for the modified part, as long as the product's overall cybersecurity is unaffected. If instead you assemble components into a product of your own, you are the regular manufacturer of the whole product. Existing tests and documentation for unchanged parts may be reused.
Browse all guidance chapters
EU Commission Guidance (C(2026) 5252 final) — The guidance reflects the European Commission's interpretation and is not legally binding. An authoritative interpretation of the EU CRA may only be given by the Court of Justice of the European Union.
Related Articles
(1)This text is reproduced from Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024. It is provided for informational purposes only and does not constitute legal advice. Only the text published in the Official Journal of the European Union is legally binding. Original text on EUR-Lex