Support period, changes, spare parts, cloud connectivity: the Commission’s CRA guidance answers questions that have been left open in the machinery and plant engineering sector for months.
On 27 July 2026 the European Commission published its guidance on the Cyber Resilience Act (C(2026) 5252).
What is the CRA guidance of the European Commission?
The CRA guidance of the European Commission is an explanatory document on Regulation (EU) 2024/2847, published on 27 July 2026. It explains scope, significant change and the support period and contains 67 examples. It is not legally binding. Only the Court of Justice of the European Union can provide a binding interpretation of the CRA.
What does it contain?
Article 26 of the CRA sets out the minimum content. The guidance accordingly addresses:
- Scope, in particular remote data processing and free and open-source software
- The concept of significant change, including software updates and spare parts
- Determination of the support period
- Risk assessment, reporting obligations and the interplay with other Union law
It also provides clarifications on core functionality, which — together with the Durchführungsverordnung (EU) 2025/2392 — determines the conformity assessment procedure.
For manufacturers in the machinery and plant engineering sector the passages on installed base business are particularly relevant: products developed before 11 December 2027 and subsequently placed on the market do not need to be redesigned if the risk assessment demonstrates appropriate measures.
What to note about the status
Formally, the Commission has so far only approved the content of the draft. The formal adoption will follow once all language versions are available. The guidance becomes applicable only from that point. Anyone citing it in testing or approval documents should be aware of this distinction.
Where to find the documents
The Communication C(2026) 5252 and the annex with the draft guidance are available for download on the publication page of the European Commission: https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation. There you will also find details on the individual topics including examples and decision trees.
How far along is your product with the CRA?
The guidance explains scope, product classes and manufacturer obligations in general. The free readiness check translates that to your product and shows in a few minutes which obligations apply and where the biggest gaps are.
