Support period, changes, spare parts, cloud connectivity — the Commission’s CRA guidance answers questions that have been open in mechanical and plant engineering for months.
On 27 July 2026 the European Commission published its guidance on the application of the Cyber Resilience Act (C(2026) 5252).
What is the Commission’s CRA guidance?
The Commission’s CRA guidance is an interpretative aid to Regulation (EU) 2024/2847, published on 27 July 2026. It explains scope, significant change and the support period and contains 67 examples. It is not legally binding. Only the Court of Justice of the European Union can provide a binding interpretation of the CRA.
What does it contain?
Article 26 of the CRA sets out the minimum contents. The guidance accordingly addresses:
- Scope, in particular remote data processing and free and open-source software
- The concept of significant change, including software updates and spare parts
- The determination of the support period
- Risk assessment, reporting obligations and interaction with other Union law
It also includes clarifications on core functionality, which, together with the Durchführungsverordnung (EU) 2025/2392, determine the conformity assessment procedure.
For manufacturers in mechanical and plant engineering, the passages on legacy business are particularly relevant: products developed before 11 December 2027 and placed on the market afterwards do not need to be re-engineered if the risk assessment demonstrates appropriate measures.
What to note about the status
Formally, the Commission has so far only approved the content of the draft. The formal adoption will follow once all language versions are available. The guidance becomes applicable only from that point. Anyone citing it in testing or approval documents should be aware of the distinction.
Where can the documents be found?
The Communication C(2026) 5252 and the annex with the draft guidance are available for download on the European Commission publication page: https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation. There you will also find details on individual topics, including examples and decision trees.
