Support period, changes, spare parts, cloud connectivity — the CRA Guidance of the European Commission answers questions that have been open in the machinery and plant engineering sector for months.
On 27 July 2026 the European Commission published its guidance on the application of the Cyber Resilience Act (C(2026) 5252).
What is the CRA guidance of the European Commission?
The CRA Guidance of the European Commission is an interpretative aid to Regulation (EU) 2024/2847, published on 27 July 2026. It explains scope, significant change and the support period and contains 67 examples. It is not legally binding. A binding interpretation of the CRA can only be provided by the Court of Justice of the European Union.
What does it contain?
Article 26 of the CRA sets out the minimum contents. The Guidance accordingly addresses:
- scope, in particular Remote Data Processing and free and open‑source software
- the concept of significant change, including software updates and spare parts
- the determination of the support period
- risk assessment, reporting obligations and the interaction with other Union law
In addition there are clarifications on core functionality, which together with the Implementing Regulation (EU) 2025/2392 decide on the conformity assessment procedure.
For manufacturers in the machinery and plant engineering sector the passages on after‑sales business are particularly relevant: products that were developed before 11 December 2027 and placed on the market afterwards do not have to be redesigned if the risk assessment documents appropriate measures.
What should be noted about the status?
Formally, the Commission has so far only approved the content of the draft. Formal adoption will follow once all language versions are available. The Guidance only applies from that point onwards. Anyone citing it in test or approval documents should be aware of the distinction.
Where can the documents be found?
The Communication C(2026) 5252 and the annex with the draft Guidance are available for download on the publication page of the European Commission (https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation). There you will also find details on the individual topics, including examples and decision trees.
How far is your product with the CRA?
The guidelines explain scope, product classes and manufacturer obligations in general. The free readiness check translates that to your product and shows in a few minutes which obligations apply and where the biggest gaps are.
