Commission guidance
The Regulation leaves many questions open: who is the manufacturer, what is a substantial modification, when does a cloud service form part of the product. The Commission guidance answers them without being legally binding.
Commission guidance consists of non-binding explanations by the European Commission on how to apply the Cyber Resilience Act, expressly provided for in Article 26 of the Regulation. The most important document is the guidance C(2026) 5252 of 27 July 2026.
Definition in the Regulation
Article 26(1) provides that the Commission publishes guidance on applying the Regulation, with a particular focus on facilitating compliance by microenterprises and small and medium-sized enterprises. The content of the guidance C(2026) 5252 was approved on 27 July 2026; formal adoption is pending until all language versions are available. It includes an annex with 67 practical examples and decision diagrams on scope, the manufacturer role, remote data processing, substantial modification, the support period and the reporting obligation. As of 7 October 2026, it had been published only in English. In addition, since 3 December 2025 the Commission has maintained a regularly updated FAQ on implementing the CRA.
What it means for manufacturers
The guidance binds neither the courts nor market surveillance authorities, but it shows how the Commission reads the Regulation. If you follow it, you have a strong argument in any dispute. Three statements matter most in practice. The manufacturer is whoever supplies the product under its own name or trademark in the course of a commercial activity (paragraph 47); for open-source software, responsibility lies with whoever exercises primary control over development, releases and distribution (paragraph 49). "Awareness" of an actively exploited vulnerability exists as soon as an initial assessment has been completed with a reasonable degree of certainty. And a cloud back end forms part of the product if the product loses a function without it and the manufacturer developed the software itself or under its responsibility. As long as the guidance exists only in English and has not been formally adopted, manufacturers should label statements taken from the guidance as "according to the Commission guidance" and not treat them as equivalent to the text of the Regulation.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Cyber Resilience Act (CRA)
- Awareness (start of the deadlines)
- Remote data processing
- Substantial modification