Privacy & Cybersecurity Law Blog

On July 27, 2026, the European Commission published practical guidance intended to help manufacturers, software developers and other businesses across the EU apply the Cyber Resilience Act (“CRA”) in practice. The guidance is designed to support organizations as they prepare for the CRA’s mandatory cybersecurity requirements for products with digital elements and its related reporting obligations. Although the guidance is nonbinding, it provides additional clarity on how the European Commission interprets several key concepts under the regulation ahead of compliance dates in 2026 and 2027.

The CRA, which entered into force on December 10, 2024, is intended to establish a uniform EU legal framework for cybersecurity requirements applicable to products with digital elements when those products are placed on the EU market and throughout their life cycle. The regulation forms part of the EU’s broader effort to strengthen cybersecurity and improve the functioning of the internal market by imposing baseline security requirements across a wide range of connected products and software.

The European Commission’s guidance was issued pursuant to Article 26 of the CRA, which requires the Commission to publish guidance to assist economic operators in applying the regulation, with particular attention to microenterprises and small and medium-sized enterprises. Consistent with that mandate, the guidance explains how the CRA applies in practice, including which products fall within scope, such as certain remote data processing solutions and free and open-source software; what constitutes a “substantial modification” under Article 3(30) of the CRA (a concept that can affect whether a product must be reassessed for compliance under the CRA); how support periods should be understood; and how to address reporting obligations, vulnerability handling and cybersecurity risk assessments.

The European Commission also emphasized that the guidance is intended to reduce unnecessary administrative burdens, especially for smaller organizations. To this end, the guidance includes practical examples, use cases, flowcharts and graphs intended to help businesses understand and operationalize their obligations. That approach aligns with the European Commission’s broader simplification agenda, including the Digital Omnibus.

The guidance also helps frame the CRA compliance timeline. Although the principal obligations will apply from December 11, 2027, reporting obligations take effect on September 11, 2026. The European Commission has also indicated that further guidance may be issued under Article 26 of the CRA as additional interpretive questions arise.

Read the European Commission’s press release here. Read the guidance here.