Substantial modification
Not every update turns a product into a new one. The Regulation draws the line at changes that affect the security requirements or the intended purpose of the product. Security fixes are left out.
A substantial modification is a change to a product after it has been placed on the market that affects its compliance with the cybersecurity requirements or changes its intended purpose. The modified version is then treated as newly placed on the market.
Definition in the Regulation
Article 3, point (30), of Regulation (EU) 2024/2847 defines a substantial modification as "a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I or which results in a modification to the intended purpose for which the product with digital elements has been assessed". Recital 39 adds detail: a security update that decreases the risk and does not modify the intended purpose is not a substantial modification. Nor, as a rule, are minor functionality updates such as new languages or pictograms. A feature update that modifies functions, type or performance is substantial, because new features enlarge the attack surface. Under recital 41, compliance must then be verified and, where applicable, a new conformity assessment carried out. Under Article 69(2), legacy products only become subject to the requirements if they undergo a substantial modification from 11 December 2027.
What it means for manufacturers
Every release needs a short assessment: does the update introduce new interfaces, connections or dependencies? Does it change what the product is intended for? Examples from the guidance and specialist sources of a substantial modification: a new remote connection, a system that now controls machines instead of displaying data, changed encryption protocols. Version numbers are irrelevant; a substantial modification can also be hidden in a minor release. The consequences: the new version is treated as newly placed on the market, only the affected aspects need to be reassessed, and it gets its own support period, which has to be determined anew but does not automatically restart. If you substantially modify someone else's product, you become the manufacturer yourself under Article 21 or 22.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Placing on the market
- Change of role
- Security update
- Support period
- Legacy products (transitional provisions)