Where certain essential cybersecurity requirements are not applicable to a product with digital elements, the manufacturer should include a clear justification in the cybersecurity risk assessment included in the technical documentation. This could be the case where an essential cybersecurity requirement is incompatible with the nature of a product with digital elements. For example, the intended purpose of a product with digital elements may require the manufacturer to follow widely recognised interoperability standards even if its security features are no longer considered to be state of the art. Similarly, other Union law requires manufacturers to apply specific interoperability requirements. Where an essential cybersecurity requirement is not applicable to a product with digital elements, but the manufacturer has identified cybersecurity risks in relation to that essential cybersecurity requirement, it should take measures to address those risks by other means, for instance by limiting the intended purpose of the product to trusted environments or by informing the users about those risks.
Recital 55
Regulation (EU) 2024/2847 — published 10 December 2024 · Last reviewed by Kunnus: March 2026
Quick Answer for Manufacturers
Recital 55 allows manufacturers to declare certain Annex I requirements as not applicable — provided this is justified in the risk assessment in the technical documentation. Example: a product without an authentication function does not require authentication security measures.
This quick answer + FAQ supplements the original legal text with practice-oriented interpretation. Only the original text is legally binding.
European Commission Interpretation
Guidance of 27 July 2026The EU Commission guidance of 27 July 2026 provides official interpretation notes on this provision. Each section: summary, key takeaways, and what it means for you in practice.
Section 2.6Complex systems and interoperability constraints
Complex systems with long development cycles, legacy components and interoperability constraints are not excluded from the CRA — but those constraints feed into the risk-based approach. Where specific essential requirements cannot (fully) be met (see recital 55), manufacturers must document the constraints, assess the risks and implement compensatory measures.
Key takeaways
- A less secure legacy protocol may be implemented where necessary for interoperability, provided the risks are mitigated by other means; where the product supports both protocols, the secure one must be the default (Example 10).
- Constraints, risks and mitigations must be transparently described in the technical documentation (Art. 31, Annex VII) and user information (Annex II).
- Constraints must be periodically reassessed during the support period; where they can be lifted, the product should be updated accordingly.
- Components purchased before the CRA applies may be integrated where the risk assessment identifies no specific risks and the product as a whole meets the requirements (Example 11).
In practice
Create a constraint dossier for every requirement you cannot (fully) meet: why it is not implementable (e.g. interoperability constraints), what risk arises, which compensatory measure applies — and schedule the reassessment. This is exactly the documentation market surveillance will want to see.
EU Commission Guidance (C(2026) 5252 final) — The guidance reflects the European Commission's interpretation and is not legally binding. An authoritative interpretation of the EU CRA may only be given by the Court of Justice of the European Union.
Common Manufacturer Questions
Can I simply ignore Annex I requirements?
No. 'Not applicable' is only permitted when the requirement conflicts with the product's function or does not serve the product's protection objective. The justification must be documented in the risk assessment.
Who reviews the non-applicability justification?
Under self-assessment, the manufacturer themselves — with exposure during market surveillance audits. Under notified body procedures, the notified body co-reviews the justification. A weak justification is a compliance risk.
Example of permissible non-applicability?
A sensor without authentication functionality that only transmits data to a controller does not need to implement the Annex I authentication requirement. But: the risk assessment must explain that no sensitive data is handled and no manipulation risk exists.
Related Articles
(1)This text is reproduced from Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024. It is provided for informational purposes only and does not constitute legal advice. Only the text published in the Official Journal of the European Union is legally binding. Original text on EUR-Lex