What happened
On 27 July 2026, the European Commission published practical guidance on applying the Cyber Resilience Act. It addresses product scope, including remote data processing solutions and free and open-source software, as well as substantial modifications, support periods, reporting, and risk assessment. [1]
The guidance includes 67 practical examples, along with use cases, flowcharts, and graphs, with particular attention to smaller businesses. It is non-binding. The main CRA obligations apply from 11 December 2027, while reporting obligations for manufacturers have applied since 11 September 2026. [1]
Why it matters for manufacturers
Manufacturers need to determine which software and connected services fall within each product’s scope, which versions remain supported, how changes are classified, and what maintenance is required throughout the declared support period.
Those decisions affect engineering capacity. Support planning needs to account for upstream software lifecycles, reproducible builds, access to representative hardware, and the tests needed when a component changes.
Use the guidance in a review involving product, engineering, and regulatory teams. The use of Linux or open-source packages alone does not determine how the CRA applies to a product. Manufacturers still need to document their product-specific assessments and decisions.
What to document for each product
- Describe the product’s boundaries, relevant software and remote services, and the reasoning behind the scope assessment.
- Align the maintenance plan with the support period, maintained firmware branches, supplier commitments, and available build and test capacity.
- Keep the rationale for maintenance changes with their source references, validation results, and release decisions.
The engineering takeaway
Use the guidance to document product scope and support commitments, then plan how maintenance will be delivered. These decisions should inform both engineering work and compliance planning.
Primary source
- European Commission: New guidance to support timely Cyber Resilience Act implementation27 July 2026. Includes the announcement, communication C(2026) 5252, and the guidance annex.
Source reviewed on . The manufacturer guidance and engineering takeaway reflect Firmdura’s analysis.