Thought Leadership
The European Commission aims to support manufacturers and developers ahead of the September deadline. A new guidance document featuring 67 practical examples is designed to answer open questions surrounding the Cyber Resilience Act.
The European Commission has published new guidance on the Cyber Resilience Act (CRA). The document is intended to help manufacturers, developers and companies of all sizes understand their obligations under the regulation, which has been in force since December 2024, and prepare for implementation in time.
The CRA requires providers of connected products, ranging from baby monitors and smartwatches to applications and traditional software, to comply with mandatory cybersecurity requirements throughout the entire product lifecycle. The regulation is considered one of the EU’s most comprehensive frameworks for securing digital products.
The Commission emphasizes that the guidance is not intended to create additional bureaucracy. Instead, it aims to ensure that companies, especially smaller businesses, receive early and practical support rather than being left to navigate the requirements alone. The Commission describes the initiative as “simplification in practice.”
Addressing Open Compliance Questions
With the new guidance, the Commission is responding to uncertainties repeatedly raised by companies and industry associations since the regulation came into effect. Key topics addressed include:
- when products fall within the scope of the CRA, for example in cases involving remote data processing or open source software
- what qualifies as a “substantial modification” of a product
- how long support periods must last
- how reporting obligations and risk assessment requirements must be implemented in practice
The guidance is designed to make compliance easier, particularly for microenterprises and small and medium-sized enterprises (SMEs). According to the Commission, it includes 67 practical examples, additional use cases, flowcharts and graphics to provide a clear and proportionate path toward compliance without unnecessary administrative burdens.
Not Legally Binding, but Highly Relevant
For companies, one aspect is particularly important: the guidance itself is not legally binding. However, it is intended to provide greater clarity before key CRA deadlines take effect.
Starting September 11, 2026, manufacturers must comply with reporting obligations, including notifications related to actively exploited vulnerabilities and serious cybersecurity incidents. The regulation’s main obligations, including conformity assessments and CE marking requirements, will apply from December 11, 2027.
The Commission also announced that it may publish additional guidance under Article 26 of the CRA if required.
Part of the EU Simplification Agenda
The publication is part of the Commission’s broader simplification strategy, which also includes the Digital Omnibus package presented in November 2025. The initiative aims, among other goals, to streamline digital regulation across the EU and reduce overlapping requirements.
This issue has become increasingly controversial among industry stakeholders due to the growing number of EU digital regulations, including the Digital Services Act (DSA), General Data Protection Regulation (GDPR), AI Act and Cyber Resilience Act.
According to the Commission, the guidance was developed in cooperation with the Expert Group on Cybersecurity of Products with Digital Elements and builds on feedback from a public consultation conducted in early 2026.
(lb)
