--- title: "CRA FAQ Hub" canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq" source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/4" author: "Sorena AI" description: "Browse the CRA FAQ hub for Blue Guide market-access concepts, CE marking, and component due diligence." published_at: "2026-03-10" updated_at: "2026-03-10" keywords: - "CRA FAQ hub" - "Cyber Resilience Act FAQ" - "CRA Blue Guide" - "CRA CE marking FAQ" - "CRA component due diligence FAQ" - "Cyber Resilience Act" - "CRA FAQ" - "CE marking" - "Blue Guide" - "component due diligence" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CRA FAQ Hub Browse the CRA FAQ hub for Blue Guide market-access concepts, CE marking, and component due diligence. *FAQ Hub* *EU* *Cyber Resilience Act* ## EU Cyber Resilience Act FAQ Browse focused CRA FAQ modules built around the questions that usually slow market access, product launch, conformity work, and component governance. Each sub-FAQ is grounded in official sources and designed for legal, compliance, product, engineering, and security teams. Use this FAQ hub when the general CRA page is too broad and you need a tighter answer set. The sub-FAQs below group high-friction questions into practical modules so teams can move faster on interpretation, evidence design, and release decisions without losing source traceability. ## Browse sub-FAQ modules ### [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md) CRA FAQ on Blue Guide concepts used in Cyber Resilience Act interpretation: placing on the market, making available, putting into service, online sales. - 28 items ### [CRA CE Marking FAQ | Meaning, Placement Rules, Software Labeling, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md) CRA CE marking FAQ covering what the mark means, when it is mandatory, software and website placement rules, packaging fallback, notified body numbers. - 26 items ### [CRA Component Due Diligence FAQ | Third-Party Components, FOSS, SBOM, Vulnerabilities](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md) CRA component due diligence FAQ covering third-party components, FOSS, CE-marked components, SBOM review, risk-based checks, upstream vulnerability reporting. - 21 items ### [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Critical and Important Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md) CRA FAQ on conformity assessment routes covering module A, module B+C, module H, important and critical products, harmonised standards, certification schemes. - 25 items ### [CRA Core Functionality FAQ | Important Products, Critical Products, Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md) CRA FAQ on core functionality covering classification of important and critical products, ancillary functions, integrated components. - 21 items ### [CRA Cybersecurity Risk Assessment FAQ | Article 13, Threat Modelling, Variants, Constraints](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md) CRA FAQ on cybersecurity risk assessment covering Article 13, threat modelling, intended purpose, foreseeable misuse, external dependencies, documentation. - 26 items ### [CRA Declaration of Conformity FAQ | Full vs Simplified, Languages, Updates, Duties](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md) CRA FAQ on the EU declaration of conformity covering full and simplified formats, required contents, languages, updates, single declarations across EU laws. - 19 items ### [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md) CRA FAQ on economic operators covering manufacturer, authorised representative, importer, distributor, responsible operator rules, checks, traceability. - 26 items ### [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md) CRA FAQ on the essential cybersecurity requirements covering Annex I Part I and Part II, applicability, evidence, interoperability constraints. - 20 items ### [CRA Hardware and Software Boundaries FAQ | Product Scope, Combined Products, Source Code](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md) CRA FAQ on hardware and software boundaries covering combined products, standalone software, source code, companion apps, remote data processing. - 26 items ### [CRA Harmonised Standards and Common Specifications FAQ | Presumption of Conformity, OJ Publication](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md) CRA FAQ on harmonised standards, common specifications, and certification schemes covering presumption of conformity, Official Journal publication. - 24 items ### [CRA Important and Critical Products FAQ | Annex III, Annex IV, Core Functionality](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md) CRA FAQ on important and critical products covering Annex III and Annex IV classification, core functionality, conformity routes, FOSS rule limits. - 30 items ### [CRA Integrated Components and Dependencies FAQ | Due Diligence, RDPS, Third-Party Components](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md) CRA FAQ on integrated components and dependencies covering due diligence, third-party components, RDPS, cloud dependencies, upstream fixes, FOSS dependencies. - 21 items ### [CRA Interplay With Other EU Laws FAQ | RED, AI Act, GDPR, Data Act, EHDS, Machinery](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md) CRA FAQ on interplay with other EU laws covering exclusions, overlap with RED, AI Act, GDPR, Data Act, EHDS, Machinery, GPSR, NIS2, aviation, marine. - 25 items ### [CRA Known Exploitable Vulnerabilities at Launch FAQ | Placement on the Market, CVEs, Late Discoveries](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md) CRA FAQ on known exploitable vulnerabilities at launch covering the launch-time rule, exploitability, known vulnerabilities, CVEs, compensating controls. - 18 items ### [CRA Legacy Products FAQ | Pre-2027 Products, Reporting, Grandfathering, Substantial Modification](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md) CRA FAQ on legacy products covering pre-11 December 2027 products, Article 14 reporting, continued sale, substantial modification, spare parts, old designs. - 21 items ### [CRA Manufacturer Obligations FAQ | Article 13 Duties, Support Period, Reporting, Documentation](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md) CRA FAQ on manufacturer obligations covering Article 13 duties, risk assessment, support periods, vulnerability handling, reporting, documentation. - 41 items ### [CRA Market Surveillance and Enforcement FAQ | Authorities, Safeguards, Sweeps, Formal Non-Compliance](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md) CRA FAQ on market surveillance and enforcement covering authorities, investigations, safeguard procedures, formal non-compliance, sweeps, joint activities. - 39 items ### [CRA Module A FAQ | Internal Control, Self-Assessment, Eligibility, Documentation](/artifacts/eu/cyber-resilience-act/faq/module-a.md) CRA FAQ on module A covering internal control, eligible products, class I limits, FOSS exception, technical documentation, testing, CE marking. - 28 items ### [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md) CRA FAQ on module B+C covering EU-type examination, conformity to type, notified-body role, certificate changes, production control, CE marking. - 32 items ### [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md) CRA FAQ on module H covering full quality assurance, quality-system approval, notified-body surveillance, scope changes, CE marking, language rules, records. - 31 items ### [CRA Notified Bodies FAQ | Notification, Scope, NANDO, Independence, Competence](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md) CRA FAQ on notified bodies covering notification, competence, independence, NANDO scope, accreditation, cross-border choice, subcontracting. - 35 items ### [CRA Open-Source Software FAQ | FOSS, Commercial Activity, Stewards, Donations, Paid Editions](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md) CRA FAQ on open-source software covering FOSS qualification, commercial activity, donations, paid support, stewards, contributors, repositories. - 39 items ### [CRA Over-the-Air Updates FAQ | OTA, Automatic Updates, Secure Distribution, Offline Paths](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md) CRA FAQ on over-the-air updates covering OTA versus automatic updates, secure distribution, screenless products, gateways, offline update paths. - 25 items ### [CRA Penalties and Fines FAQ | Fine Tiers, Turnover Caps, SME Carve-Outs, Stewards](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md) CRA FAQ on penalties and fines covering Article 64 fine tiers, turnover caps, SME carve-outs, steward exemptions, cumulative fines, criminal sanctions. - 23 items ### [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md) CRA FAQ on product families covering shared risk assessments, family-wide documentation reuse, cybersecurity-relevant variant differences. - 16 items ### [CRA Remote Data Processing Solutions FAQ | RDPS Scope, Cloud Services, SaaS Boundaries, Documentation](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md) CRA FAQ on remote data processing solutions covering Article 3(2) RDPS tests, cloud-service boundaries, websites and portals, third-party SaaS, backend scope. - 21 items ### [CRA Repairs and Spare Parts FAQ | Repairs, Refurbishment, Spare-Part Exemption, Compatibility](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md) CRA FAQ on repairs and spare parts covering substantial modification, Article 2(6) identical spare parts, non-identical replacements. - 18 items ### [CRA Reporting Obligations FAQ | Article 14 Deadlines, CSIRT Filing, User Notices, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md) CRA FAQ on reporting obligations covering Article 14 deadlines, actively exploited vulnerabilities, severe incidents, CSIRT routing, user notifications. - 35 items ### [CRA Scope FAQ | Products with Digital Elements, Connections, Software, Exclusions](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md) CRA FAQ on scope and products with digital elements covering software, firmware, components, direct and indirect connections, offline products, exclusions. - 30 items ### [CRA Secure-by-Default FAQ | Default Configuration, Auto Updates, Tailor-Made Limits](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md) CRA FAQ on secure by default covering Annex I default configuration, automatic security updates, opt-outs, components, inapplicability. - 18 items ### [CRA Security Updates vs Functionality Updates FAQ | Separation, Free Updates, Article 13(10)](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md) CRA FAQ on security updates versus functionality updates covering separation where technically feasible, free security updates, automatic updates. - 24 items ### [CRA Substantial Modification FAQ | Post-Market Changes, New Manufacturer, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md) CRA FAQ on substantial modification covering Article 3(30), software updates, repairs, new manufacturer status, conformity reassessment. - 27 items ### [CRA Support Period FAQ | Placement on the Market, Unit-Level Timing, Update Availability](/artifacts/eu/cyber-resilience-act/faq/support-period.md) CRA FAQ on support periods covering Article 13(8), placement on the market timing, unit-level support periods, standalone software, update availability. - 71 items ### [CRA Tailor-Made Products FAQ | Business-User Exception, Paid Updates, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md) CRA FAQ on tailor-made products covering the narrow business-user carve-out, secure-by-default and paid-update deviations, required evidence. - 17 items ### [CRA Technical Documentation FAQ | Annex VII, Languages, Authority Access, Updates](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md) CRA FAQ on technical documentation covering Annex VII content, timing, languages, versioning, authority access, reused documentation, simplified formats. - 21 items ### [CRA Transition Period FAQ | Key Dates, Legacy Products, Pre-CRA Stock, RED Interplay](/artifacts/eu/cyber-resilience-act/faq/transition-period.md) CRA FAQ on the transition period covering entry into force, phased application dates, legacy products, stock and customs timing, standalone software. - 23 items ### [CRA Update Availability and Archives FAQ | Article 13(9), Archives, Historical Versions](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md) CRA FAQ on update availability and software archives covering Article 13(9), Article 13(10), Article 13(11), retention of issued security updates. - 24 items ### [CRA User Information and Transparency FAQ | Annex II, Support Disclosure, User Notices](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md) CRA FAQ on user information and transparency covering Annex II instructions, support-period disclosure, end-of-support notices, vulnerability notices. - 28 items ### [CRA Vulnerability Handling FAQ | Lifecycle Duties, Components, Disclosure, Fix Sharing](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md) CRA FAQ on vulnerability handling covering Annex I Part II duties, component vulnerabilities, upstream reporting and fix sharing. - 29 items Browse all indexed questions: [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md) ## All FAQ items *Page 4 of 54. Showing 20 of 1072 items.* ### [If a component does bear the CE marking, can the manufacturer rely on that?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#if-a-component-does-bear-the-ce-marking-can-the-manufacturer-rely-on-that) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* Yes, but only as supporting evidence. Sources for this answer: - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - section 4.4.1 - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 7.3, point 155 ### [What if the component was integrated before the CRA became applicable and cannot yet be checked for CRA conformity?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#what-if-the-component-was-integrated-before-the-cra-became-applicable-and-cannot-yet-be-checked-for-cra-conformity) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* The CRA anticipated that situation. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - recital 35 - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - section 4.4.1 ### [How is component due diligence different from the CRA cybersecurity risk assessment?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#how-is-component-due-diligence-different-from-the-cra-cybersecurity-risk-assessment) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* They are distinct but complementary obligations. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(2) to Article 13(5) - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 7.3, points 151 to 157 ### [What kind of evidence can support CRA component due diligence in practice?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#what-kind-of-evidence-can-support-cra-component-due-diligence-in-practice) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* The draft Commission guidance says evidence may consist of documentation obtained from the component manufacturer, such as technical specifications, security documentation, or relevant conformity or assurance documentation. Where appropriate, the manufacturer may also carry out functional tests on the component. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(7), Article 31 and Annex VII - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 7.3, point 155 ### [Does the CRA require the manufacturer to make the component SBOM public?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#does-the-cra-require-the-manufacturer-to-make-the-component-sbom-public) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* No. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - recital 77, Annex I Part II point 1, and Annex VII point 6(b) - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - section 4.4.2 ### [What happens if the manufacturer identifies a vulnerability in an integrated component?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#what-happens-if-the-manufacturer-identifies-a-vulnerability-in-an-integrated-component) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* The manufacturer must report the vulnerability to the person or entity manufacturing or maintaining the component and must address and remediate it in line with the CRA's vulnerability-handling requirements. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(6) - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - section 4.3.6 - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 9.2.1, points 201 to 205 ### [Can the integrating manufacturer rely on the component manufacturer's own vulnerability handling?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#can-the-integrating-manufacturer-rely-on-the-component-manufacturers-own-vulnerability-handling) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* Often yes, but not completely. Sources for this answer: - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - section 4.3.6 - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(6) to Article 13(8) ### [If the manufacturer contributes code to an upstream FOSS component, does that make it responsible for that component's own CRA compliance?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#if-the-manufacturer-contributes-code-to-an-upstream-foss-component-does-that-make-it-responsible-for-that-components-own-cra-compliance) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* No, not by itself. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - recital 18 and Article 13(5) - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 3.4, points 80 to 83 ### [How does due diligence work for open-source components that are outside the CRA manufacturer regime?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#how-does-due-diligence-work-for-open-source-components-that-are-outside-the-cra-manufacturer-regime) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* The same due-diligence obligation still applies. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(5), Article 25 and recital 34 - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - section 4.4.4 - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 3.4, points 81 to 83 ### [How should manufacturers treat integrated third-party SaaS, PaaS or similar solutions that are necessary for product functions but are not designed or developed by the manufacturer?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#how-should-manufacturers-treat-integrated-third-party-saas-paas-or-similar-solutions-that-are-necessary-for-product-functions-but-are-not-designed-or-developed-by-the-manufacturer) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* The draft guidance says those solutions should be treated like third-party components. Sources for this answer: - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 8.2.1, points 185 and 186, and section 8.3.1 to 8.3.3 ### [Does every external dependency need Article 13(5) due diligence?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#does-every-external-dependency-need-article-135-due-diligence) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* No. Sources for this answer: - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 8.3.5 ### [Must the manufacturer report upstream if the component no longer has a maintainer or if the manufacturer maintains an independent fork?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#must-the-manufacturer-report-upstream-if-the-component-no-longer-has-a-maintainer-or-if-the-manufacturer-maintains-an-independent-fork) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* Not necessarily. Sources for this answer: - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 9.2.1, point 203 ### [If the manufacturer shares a security fix upstream, must it ensure that the maintainer accepts or merges it?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#if-the-manufacturer-shares-a-security-fix-upstream-must-it-ensure-that-the-maintainer-accepts-or-merges-it) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* No. Sources for this answer: - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 9.2.1, points 205 to 207 ### [Does the support period of integrated components matter for CRA component due diligence?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#does-the-support-period-of-integrated-components-matter-for-cra-component-due-diligence) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* Yes. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(8) - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - sections 4.4.2 and 4.3.7 ### [Does due diligence mean proving that every component is perfect or vulnerability-free before integration?](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md#does-due-diligence-mean-proving-that-every-component-is-perfect-or-vulnerability-free-before-integration) *Module: [CRA Component Due Diligence](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md)* No. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(5) to Article 13(8) and recital 34 - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - sections 4.3.6, 4.4.2 and 4.4.3 - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - section 7.3, points 154 to 157 ### [What conformity assessment routes does the CRA recognise?](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md#what-conformity-assessment-routes-does-the-cra-recognise) *Module: [CRA Conformity Assessment Routes](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)* The CRA recognises four ways to demonstrate conformity with the essential cybersecurity requirements: Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32(1) and Annex VIII - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - section 6 ### [What decides which CRA conformity assessment route a manufacturer has to use?](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md#what-decides-which-cra-conformity-assessment-route-a-manufacturer-has-to-use) *Module: [CRA Conformity Assessment Routes](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)* The starting point is the product's classification under the CRA. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 7(1), Article 8(1) and Article 32 - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - sections 3.1, 3.2 and 6 - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - points 121 to 123 and 126 ### [Which CRA conformity assessment route applies to products in the default category?](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md#which-cra-conformity-assessment-route-applies-to-products-in-the-default-category) *Module: [CRA Conformity Assessment Routes](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)* Products in the default category can always use module A. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32(1) - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - section 6.1 and section 6.2 - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - point 122 ### [When can an important product of class I use module A?](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md#when-can-an-important-product-of-class-i-use-module-a) *Module: [CRA Conformity Assessment Routes](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)* An important product of class I can use module A if, in assessing compliance, the manufacturer has applied relevant harmonised standards, common specifications, or European cybersecurity certification schemes at assurance level at least substantial. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27 and Article 32(2) - [European Commission CRA FAQs (January 2026)](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - sections 6.1 and 6.2 ### [What if a harmonised standard covers the core functionality of an important class I product, but not every cybersecurity risk of the full product?](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md#what-if-a-harmonised-standard-covers-the-core-functionality-of-an-important-class-i-product-but-not-every-cybersecurity-risk-of-the-full-product) *Module: [CRA Conformity Assessment Routes](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md)* The draft Commission guidance takes the view that the manufacturer may still use internal control if the harmonised standard covers the product's core functionality. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(1), Article 27(5), Article 32(2) and Annex VII point 5 - [Draft Commission guidance on the CRA (March 2026 draft)](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - points 132 to 139 ## FAQ Pagination - Canonical index (page 1): [/artifacts/eu/cyber-resilience-act/faq/items](/artifacts/eu/cyber-resilience-act/faq/items.md) - Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL. - Current page: 4 of 54 Pages: [1](/artifacts/eu/cyber-resilience-act/faq/items.md) | [2](/artifacts/eu/cyber-resilience-act/faq/items/page/2.md) | [3](/artifacts/eu/cyber-resilience-act/faq/items/page/3.md) | [4](/artifacts/eu/cyber-resilience-act/faq/items/page/4.md) | [5](/artifacts/eu/cyber-resilience-act/faq/items/page/5.md) | [6](/artifacts/eu/cyber-resilience-act/faq/items/page/6.md) | [7](/artifacts/eu/cyber-resilience-act/faq/items/page/7.md) | [8](/artifacts/eu/cyber-resilience-act/faq/items/page/8.md) | [9](/artifacts/eu/cyber-resilience-act/faq/items/page/9.md) | [10](/artifacts/eu/cyber-resilience-act/faq/items/page/10.md) | [11](/artifacts/eu/cyber-resilience-act/faq/items/page/11.md) | [12](/artifacts/eu/cyber-resilience-act/faq/items/page/12.md) | [13](/artifacts/eu/cyber-resilience-act/faq/items/page/13.md) | [14](/artifacts/eu/cyber-resilience-act/faq/items/page/14.md) | [15](/artifacts/eu/cyber-resilience-act/faq/items/page/15.md) | [16](/artifacts/eu/cyber-resilience-act/faq/items/page/16.md) | [17](/artifacts/eu/cyber-resilience-act/faq/items/page/17.md) | [18](/artifacts/eu/cyber-resilience-act/faq/items/page/18.md) | [19](/artifacts/eu/cyber-resilience-act/faq/items/page/19.md) | [20](/artifacts/eu/cyber-resilience-act/faq/items/page/20.md) | [21](/artifacts/eu/cyber-resilience-act/faq/items/page/21.md) | [22](/artifacts/eu/cyber-resilience-act/faq/items/page/22.md) | [23](/artifacts/eu/cyber-resilience-act/faq/items/page/23.md) | [24](/artifacts/eu/cyber-resilience-act/faq/items/page/24.md) | [25](/artifacts/eu/cyber-resilience-act/faq/items/page/25.md) | [26](/artifacts/eu/cyber-resilience-act/faq/items/page/26.md) | [27](/artifacts/eu/cyber-resilience-act/faq/items/page/27.md) | [28](/artifacts/eu/cyber-resilience-act/faq/items/page/28.md) | [29](/artifacts/eu/cyber-resilience-act/faq/items/page/29.md) | [30](/artifacts/eu/cyber-resilience-act/faq/items/page/30.md) | [31](/artifacts/eu/cyber-resilience-act/faq/items/page/31.md) | [32](/artifacts/eu/cyber-resilience-act/faq/items/page/32.md) | [33](/artifacts/eu/cyber-resilience-act/faq/items/page/33.md) | [34](/artifacts/eu/cyber-resilience-act/faq/items/page/34.md) | [35](/artifacts/eu/cyber-resilience-act/faq/items/page/35.md) | [36](/artifacts/eu/cyber-resilience-act/faq/items/page/36.md) | [37](/artifacts/eu/cyber-resilience-act/faq/items/page/37.md) | [38](/artifacts/eu/cyber-resilience-act/faq/items/page/38.md) | [39](/artifacts/eu/cyber-resilience-act/faq/items/page/39.md) | [40](/artifacts/eu/cyber-resilience-act/faq/items/page/40.md) | [41](/artifacts/eu/cyber-resilience-act/faq/items/page/41.md) | [42](/artifacts/eu/cyber-resilience-act/faq/items/page/42.md) | [43](/artifacts/eu/cyber-resilience-act/faq/items/page/43.md) | [44](/artifacts/eu/cyber-resilience-act/faq/items/page/44.md) | [45](/artifacts/eu/cyber-resilience-act/faq/items/page/45.md) | [46](/artifacts/eu/cyber-resilience-act/faq/items/page/46.md) | [47](/artifacts/eu/cyber-resilience-act/faq/items/page/47.md) | [48](/artifacts/eu/cyber-resilience-act/faq/items/page/48.md) | [49](/artifacts/eu/cyber-resilience-act/faq/items/page/49.md) | [50](/artifacts/eu/cyber-resilience-act/faq/items/page/50.md) | [51](/artifacts/eu/cyber-resilience-act/faq/items/page/51.md) | [52](/artifacts/eu/cyber-resilience-act/faq/items/page/52.md) | [53](/artifacts/eu/cyber-resilience-act/faq/items/page/53.md) | [54](/artifacts/eu/cyber-resilience-act/faq/items/page/54.md) [Previous page](/artifacts/eu/cyber-resilience-act/faq/items/page/3.md) | [Next page](/artifacts/eu/cyber-resilience-act/faq/items/page/5.md) *Recommended next step* *Placement: after the FAQ section* ## Use the CRA FAQ hub as a cited research workflow Research Copilot can turn recurring CRA interpretation questions into a reusable workflow tied to your products, evidence, and owners. - [Open Research Copilot](/solutions/research-copilot.md): Answer CRA scope, conformity, CE marking, and component questions with cited outputs. - [Talk through your CRA rollout](/contact.md): Review product decisions, evidence gaps, and launch blockers with the Sorena team. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/items/page/4