A REGULATORY DISCOUNT FOR SUBSTANTIAL MODIFICATIONS UNDER THE CRA?

“Substantial modification” is a key concept in EU harmonisation legislation, as the law attaches important legal consequences to it. Under the EU Cyber Resilience Act (Regulation 2024/2847, the CRA) a substantially modified product with digital elements (PDE) becomes a new product. That interpretation stems from the general principles of EU product legislation as explained in the Commission’s Blue Guide on the implementation of product rules. Because a new product is created, the person making the modification may assume the manufacturer’s responsibilities. Moreover, a substantial modification may bring a product placed on the market before the CRA applies (11 December 2027) within its scope. Given the importance of the concept in the day-to-day distribution of PDEs, the CRA itself obliges the European Commission to publish guidance on it. The Commission did so in its Guidance of July 2026. 

On a critical point, the Guidance departs from the text of the CRA. It introduces “proportionality considerations” to interpret the consequences of a substantial modification, under which the person making it is in most cases responsible only for the part of the PDE it modified. The literal text of the CRA reserves that lenient approach for one category of persons only. This post explains the rule, the Commission’s reading and why the difference matters for manufacturers, importers and distributors. 

THE RULE IN THE CRA 

Article 3(30) CRA defines a substantial modification as “a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I or which results in a modification to the intended purpose for which the product with digital elements has been assessed”. In other words, it is a change to a product supplied in the EU that either affects its compliance with the CRA or modifies the purpose for which the original manufacturer intended it. The definition can be unpacked into various components, but this post focuses on the effects of a substantial modification. 

Under the CRA, the consequences of a substantial modification depend on who makes it. The CRA distinguishes three categories of persons: 

• First, manufacturers should be mindful of the changes they themselves make to their PDEs after they have been placed on the market. For classic products, a manufacturer modifying its own product after it has been placed on the market is of limited relevance in practice, since the manufacturer would generally have to regain access to the product after supply to do so. PDEs are different. The manufacturer often retains a large degree of control over the product after supply, for example where it can send updates that change how the product functions. This is particularly significant for software development, which is frequently iterative and rarely ends after the software has been supplied to the customer. 

  Where a change qualifies as a substantial modification, the manufacturer is considered to have supplied a new product on the EU market. All its compliance obligations are triggered for that new product: it must perform a new risk assessment, reassess the product’s compliance with the essential cybersecurity requirements, and it may have to undergo a new conformity assessment procedure. 

  The same logic applies to legacy products. Under Article 69(2) CRA, products placed on the market before 11 December 2027 are subject to the requirements of the CRA if, from that date, they have been subject to a substantial modification. A pre-CRA PDE that receives an update constituting a substantial modification therefore falls within the scope of the CRA. 

• Second, under Article 21 CRA, importers or distributors that substantially modify a PDE already placed on the market assume the responsibilities of the manufacturer and must comply with Articles 13 and 14 CRA. A distributor of hardware appliances that adapts the firmware before reselling the devices, or an importer that installs its own firmware on an IoT product for the European market, is treated as the manufacturer of the entire product. 

  The provision ensures that, even where the manufacturer loses control over its PDE because of changes made further down the supply chain, the end customer can rely on the product complying with the CRA. 

• Third, Article 22 CRA addresses modifications made by persons outside the distribution chain. These include repair shops, integrators that customise equipment for a customer and later resell it, or even an end-user that modifies a product and puts it back on the market. Under Article 22(1) CRA, such a person assumes the responsibilities of the manufacturer where it carries out a substantial modification and then makes the PDE available on the market. If it does not make the PDE available on the market, it remains outside the scope of the CRA’s obligations. 

  These third parties are outside the general supply chain of the PDE and often have only limited information about the product. For this reason, the EU legislator likely opted for a more lenient approach. Article 22(2) CRA limits their obligations to the part of the product affected by the substantial modification, unless the modification negatively affects the cybersecurity of the PDE as a whole. Only in that case does the third party assume all manufacturer responsibilities. For the unmodified parts, the original manufacturer remains responsible. 

WHY THE DISTINCTION MATTERS 

Article 22(2) CRA is the only provision in the CRA that limits manufacturer responsibility to part of a product. It is an exception with a specific rationale. A repair shop or an end-user that alters one component of a product it did not design has neither the technical documentation nor the risk assessment of the original manufacturer. Holding it responsible for the entire product would be disproportionate. That rationale does not extend to importers and distributors, which are economic operators with their own obligations under Articles 19 and 20 CRA and have a more direct relationship with the manufacturer. It extends even less to the original manufacturer, which designed the product, holds its technical documentation and is best placed to bring it into conformity. 

The limitation also comes at a price. It will not always be clear which parts of a product are “affected” by a modification, and the assessment of the impact on the PDE as a whole leaves room for discussion. The EU legislator accepted that uncertainty only for third parties. For manufacturers, importers and distributors, it kept the general rule of EU harmonisation legislation that the substantially modified product is a new product, and the person placing it on the market is responsible for it as a whole. 

THE COMMISSION’S GUIDANCE OF JULY 2026 

In its Guidance, the Commission seeks to limit significantly the effects of a substantial modification on the compliance obligations of the person making it. The Commission does not explain its reasoning, but its approach was likely prompted by how common substantial modifications are across the EU market, given that software falls within the definition of a PDE. Moreover, the Commission completely reversed its position on this point compared to the initial draft of the Guidance, which suggests that it came under pressure to do so during the public consultation. The Commission therefore generally introduced “proportionality considerations”, which means that in practice, it applies Article 22(2) CRA, which concerns only third parties outside the distribution chain (see above), to all economic operators in the supply chain. 

For importers and distributors, the Guidance treats Articles 21 and 22 CRA together (section 4.4.1 Commission Guidance July 2026). Importers and distributors that substantially modify a PDE are said to be responsible only for the part of the PDE affected by the modification, provided that the modification does not negatively affect the cybersecurity of the PDE as a whole. The original manufacturer’s obligations continue to apply for the unmodified parts. 

For manufacturers, the Guidance applies the same reasoning, albeit in a more limited fashion (section 4.4.2 Commission Guidance July 2026). Where the manufacturer placed a PDE on the market before 11 December 2027 and subsequently makes a substantial modification, it is not required to bring the whole PDE into conformity with the CRA, unless the modification negatively affects the cybersecurity of the PDE as a whole. Its compliance obligations are said to be limited to the substantially modified parts. Note that this new position of the Commission also deviates from what it states in the CRA FAQ version 1.4 (see question 1.4). 

Neither position is substantiated in the Guidance, and both contradict the express text of the CRA. Article 22(2) CRA refers back to “the person referred to in paragraph 1 of this Article”, being “a natural or legal person, other than the manufacturer, the importer or the distributor”. Article 21 CRA contains no equivalent limitation for importers and distributors. Article 69(2) CRA subjects the substantially modified legacy product to “the requirements set out in this Regulation”, not to the requirements for the modified part. That said, the Blue Guide, on which the Commission relies, allows the person making the changes to reuse existing tests and documentation for aspects that the modification does not affect. That, however, is only a matter of evidence. The Blue Guide also states that this person is responsible for the conformity of the (entire) modified product and must draw up a declaration of conformity for it. 

The Commission’s reading is pragmatic and very supply-chain friendly. It is, however, merely guidance, albeit persuasive, and does not have the force of law. It remains to be seen whether this interpretation will hold up before the European Court of Justice. 

PRACTICAL CONSEQUENCES 

Importers and distributors that adapt the products they sell should be cautious about taking the Guidance at face value. 

• Under Article 21 CRA, an importer or distributor that substantially modifies a PDE is the manufacturer of the entire product. It must be able to demonstrate the compliance of the product as a whole, including the technical documentation, the conformity assessment, the EU declaration of conformity and the vulnerability handling and reporting obligations under Article 14 CRA. 

• Manufacturers face a similar choice for their installed base, the legacy PDEs already on the market before the CRA applies. A manufacturer that rolls out a major update to products placed on the market before 11 December 2027 may be tempted to rely on paragraph 124 of the Guidance and limit its compliance work to the modified parts. Under Article 69(2) CRA as written, the modified product as a whole is subject to the CRA in full. At a minimum, the manufacturer should document why the modification does not negatively affect the cybersecurity of the PDE as a whole and be prepared to bring the product into full conformity where a market surveillance authority takes the stricter view.

  Under Article 69(3) CRA, the reporting obligations of Article 14 CRA apply in any event to all legacy products, modified or not. 

In both cases, parties allocating responsibility in the supply chain should consider following the text of the Regulation rather than the Guidance. Distribution agreements, warranties and insurance arrangements that assume the original manufacturer remains responsible for the unmodified parts of a product rest on a reading the CRA does not support. 

Timelex advises manufacturers, importers, distributors and integrators on the scope and obligations of the CRA, including substantial modification assessments, conformity assessment strategies and the allocation of responsibility in the supply chain. Feel free to contact us at pedro.demolder@timelex.eu or lotte.degraeve@timelex.eu to discuss how these rules apply to your products.