Legacy products under the Cyber Resilience Act: why the deadline applies to each individual hardware unit

In our CRA projects and in scoping discussions with manufacturers, one question comes up regularly, and few are debated as intensely: “Our device has been on the market since 2024. That makes it a legacy product the Cyber Resilience Act does not apply to, right?” The question affects production plans: production runs that extend beyond 2027, framework agreements with long delivery schedules, end-of-life roadmaps, and the decision whether a model needs to be reworked before the deadline.

For physical products, the CRA’s transition rule applies to individual units rather than product models. Every unit that falls within the CRA’s scope and is supplied on the EU market for the first time on or after 11 December 2027 has to meet the requirements of Regulation(EU)2024/2847 , even if the model has been on sale for years. This reading matches the European Commission’s interpretation in the Blue Guide, the CRA FAQ and the CRA guidance. Those documents are not legally binding; no interpretation by the Court of Justice of the European Union exists yet. Standalone software follows a rule of its own, covered below.

What Article 69(2) CRA says about legacy products

The transitional provision in Article 69(2) CRA reads:

“Products with digital elements that have been placed on the market before 11 December 2027 shall be subject to the requirements set out in this Regulation only if, from that date, those products are subject to a substantial modification.”

Everything therefore depends on the concept of placing on the market. Article 3 CRA defines it in two steps:

• Placing on the market (point 21) means “the first making available of a product with digital elements on the Union market”.
• Making available on the market (point 22) means “the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge”.

The wording alone does not settle the question. The Commission explains these concepts expressly in the Blue Guide, the CRA FAQ and its CRA guidance. The Commission distinguishes two things: what counts as an individual product, and when that product is legally considered placed on the market. For physical products, the word “first” accordingly does not separate the first unit of a model from all later units. It separates the first supply of a unit from all further supplies of the same unit along the supply chain:

Why everyday language invites the misunderstanding

There are understandable linguistic reasons why many product owners initially assume the model-based reading; we know them from project discussions, although they cannot be established from the legal sources:

• “Placing a product on the market” sounds like a product launch. In the legal sense, it refers to the moment a specific unit is first supplied, that is, passes to another economic operator or user by offer or agreement.
• “Product” in day-to-day business usually means a product line or model (“our product X”). In EU product legislation, the “product” is the individual item.
• “Legacy product” (German: “Bestandsprodukt”) is not a defined term. The CRA uses “legacy products” in recital 29 (German: “Altprodukte”) but does not define it; Article 69(2) determines the transitional treatment by reference to when the product was placed on the market. In product management it denotes a model that has already been launched; in CRA discussions it is used for goods that have already been supplied. The term legacy unit is more precise. In German-language discussions the ambiguity is particularly pronounced, because “Bestandsprodukt” is firmly established in product management as the opposite of a new product.
• Article 69(1) does in fact deal with type-related documents: EU type-examination certificates and approval decisions issued regarding cybersecurity requirements under other Union harmonisation legislation (such as the Radio Equipment Directive) can be relied on for CRA purposes until 11 June 2028 at the latest, unless they expire earlier; their validity under the other legislation is a separate matter. A further possible reason for the misunderstanding: reading paragraphs 1 and 2 together makes it easy to carry the type reference over to paragraph 2. Paragraph 2, however, refers solely to the placing on the market.

How the European Commission interprets the concept

The Commission holds this interpretation consistently across three documents. They carry different weight: the Blue Guide is the interpretative document for all harmonised EU product legislation, updated over decades; the FAQ are a working aid by the Commission services; the guidance is the instrument the Commission is tasked with under Article 26 CRA.

Blue Guide 2022: “each individual product, not a type of product”

The BlueGuideontheimplementationofEUproductrules2022 (Commission notice 2022/C 247/01, OJ C 247 of 29 June 2022) is the central interpretative document for the New Legislative Framework (NLF). The CRA takes the concepts “making available on the market” and “placing on the market” from this framework word for word. Section 2.3 states:

“As for ‘making available’, the concept of placing on the market refers to each individual product, not to a type of product, and whether it was manufactured as an individual unit or in series. Consequently, placing on the Union market can only happen once for each individual product across the EU and does not take place in each Member State.”

The same section then describes precisely the transitional situation that Article 69(2) CRA regulates:

“Even though a product model or type has been supplied before new Union harmonisation legislation laying down new mandatory requirements entered into force, individual units of the same model or type, which are placed on the market after the new requirements have become applicable, must comply with these new requirements.”

Section 2.2 also defines what a supply is: “an offer or an agreement (written or verbal) between two or more legal or natural persons for the transfer of ownership, possession or any other right concerning the product in question after the stage of manufacture has taken place. The transfer does not necessarily require the physical handover of the product.” That is the yardstick for the transition test at the end of this post.

CRA FAQ by the Commission services: the router example

The FAQonCRAimplementation (version 1.4 of 4 September 2026) are a working aid by the Commission services and, by their own account, not the Commission’s official position. But no other document addresses the question of this post as directly. Section 7.2 is headed “A manufacturer develops a product type before the CRA applies. Can it continue to manufacture products identical to that type after the CRA applies?” and answers:

“Union harmonisation legislation including the CRA applies to individual products, and not product types. Therefore, only individual products that have been placed on the market before 11 December 2027 do not need to comply with the CRA. Products that are manufactured according to a type that is not compliant with the CRA cannot be placed on the market on or after 11 December 2027, even if the first instance of that product ’type’ has been placed on the market before 11 December 2027.”

The FAQ illustrate this with an example of their own: a manufacturer produces 10,000 routers according to a type that is not CRA-compliant and places them on the market before the deadline. It does not need to bring these units into compliance, “even if those units have not reached their final user”. It may not place another 5,000 units of the same type on the market after the deadline, “as those 5 000 copies would not be compliant with the CRA”.

Section 6.4 (“Are manufacturers required to ensure the conformity of ’existing’ product types?”) makes the same point from the conformity-assessment angle:

“The CRA is applicable to products placed as individual units on the market as of its date of applicability. In other words, legacy types or models are not exempted from the application of the CRA if, after the aforementioned date, new units are placed on the market.”

Section 1.4 illustrates the converse situation: a smart TV placed on the market in mid-2027 does not have to comply with the CRA, not even after a bug-fix update in 2028. Only an update that qualifies as a substantial modification, such as newly enabling the control of smart home systems, changes that.

Commission CRA guidance: section 2.7 on products designed before the CRA

The CommissionguidanceunderArticle26CRA (annex to C(2026) 5252 final of 27 July 2026) adopts the Blue Guide wording in para. 11: placing on the market and making available refer “to each individual product, not to a type of product, and whether it was manufactured as an individual unit or in series”. Above all, it dedicates a separate section 2.7 (“Products with digital elements designed before the CRA entered into application”) to this situation. Para. 33 describes the case:

“In some cases, a manufacturer will place on the market, after the CRA enters into application on 11 December 2027, units of a product with digital elements manufactured in accordance with a type or model designed and developed before the date of application of the CRA. In such cases, compliance with this Regulation does not necessarily require that those units of the product with digital elements be redesigned.”

New units of an old model placed on the market after the deadline are therefore subject to the CRA; how compliance can be demonstrated without redesign is described in paras. 33 to 39 and example 12 on a microcontroller designed before the CRA. Footnote 31 explains the treatment of units already placed on the market: units placed on the market before the deadline are subject to the Union legislation applicable at that time and, if they were compliant, can continue to be sold and put into operation “unless they are, on or after 11 December 2027, subjected to substantial modifications”. We have covered further questions from the guidance in our post on fiveproductdecisions .

What this means in practice: model or unit?

For physical products with digital elements, such as IoT devices, controllers or network components, the following rules apply:

A model of which new units are to be placed on the market after the deadline needs a completed conformity assessment, an EU declaration of conformity and CE marking under the CRA before placing the first such unit on the market; the deadline itself does not require completion in December 2027 if the first new unit only follows later (guidance, para. 35). This also holds where the components used were themselves bought or placed on the market before the deadline: integrating them into a new finished product is a placing on the market of that product in its own right, not a modification of an existing one (guidance, para. 120, examples 11 and 51). Units supplied as identical spare parts for existing products remain exempt (Article 2(6) CRA).

Software: when is a version placed on the market?

Standalone software has no physical unit. The guidance resolves this as follows (paras. 13 to 15): once the manufacturing phase of a software version is complete and it is first offered for distribution or use on the Union market in the course of a commercial activity, all copies of that version are considered placed on the market at that moment, regardless of when an individual customer downloads or buys a copy. The first offering in the EU is what counts: a version offered only outside the EU before the deadline does not acquire an earlier placing date through a later first supply in the EU.

For software roadmaps this means that, for every new version, the first question is whether it is still the same product or already a distinct variant with its own date of placing on the market:

• An unchanged version first offered before 11 December 2027 can, according to the guidance, continue to be distributed afterwards without each individual copy having to be reassessed.
• Variants that differ in components, configurations or functionality (for example builds for different operating systems or editions with different feature sets) are treated as distinct products, each with its own date of placing on the market.
• New versions are only considered newly placed on the market if they constitute a substantial modification. Ordinary updates without a substantial modification do not change the date. Under the guidance, keeping the original status is the exception for updates without a substantial modification, not the rule: the more the version, functionality, build, edition, operating system variant or security architecture differ, the more likely it is that a distinct variant exists.

An open flank: the asymmetry between hardware and software

This interpretation in the guidance produces a striking asymmetry; it does not follow from the text of the Regulation itself. A newly manufactured hardware unit of an unchanged model has to meet the CRA requirements from the deadline. Another copy of an unchanged pre-deadline software version, by contrast, keeps its earlier placing date, and so does a later version without a substantial modification. The difference does not follow from how easily a product can be modified but from the treatment of placing on the market: hardware units enter the market individually, identical software copies are treated as placed on the market together.

Two qualifications belong here. First, “exempt from the full requirements” does not mean “compliant”: the software does not automatically meet the essential requirements, it merely does not have to demonstrate them; the Article 14 reporting obligations apply to it as to any legacy product (para. 210). Second, the guidance sets no expiry for this treatment (para. 15); the only boundary is substantial modification. “Not substantial” does not mean “no new functionality”: functionality that was assessed in advance can be added below the threshold (para. 106), and the guidance contains no yardstick for the sum of many small changes. A manufacturer that keeps developing software first offered before the deadline over several years should therefore not assume that staying below the threshold release by release secures the exemption indefinitely. In our view, each release should be checked not only against the previous version but against the originally assessed state. Whether the Commission has drawn a sufficiently clear boundary here remains open.

Firmware shipped on a device is generally part of that device unit and therefore follows the unit-based logic of the hardware. Firmware placed on the market separately can itself be a product within the meaning of the CRA.

Substantial modification: when a legacy unit does fall under the CRA after all

The only exception to the transition rule is a substantial modification after the deadline. Article 3(30) CRA defines it as a change following the placing on the market that either affects compliance with the essential requirements in Annex I Part I or modifies the intended purpose for which the product was assessed. An importer or distributor that carries out such a modification is considered the manufacturer under Article 21 CRA; for any other person who makes the modified product available, this follows from Article 22 CRA. For the original manufacturer, the guidance derives the same result from the general concept of substantial modification (recital 41, paras. 115–116): making a substantially modified product available counts as a new placing on the market, whoever carried out the modification (paras. 116–117).

What is generally not a substantial modification (guidance, sections 4.1 to 4.3):

• Continued operation by the end customer. Continuing to use a legacy unit is not a placing on the market. The CRA does not become applicable merely because a device keeps running after the deadline.
• Repair, maintenance and refurbishment. According to the guidance, replacing defective or worn parts is not a substantial modification even if the new part performs better, for example because the old one is no longer produced (paras. 93 to 95). The line is crossed where the change affects compliance with the essential requirements or extends the intended purpose beyond what the risk assessment covered.
• Spare parts: Is the replacement part itself exempt? Identical components according to the same specifications are excluded from the CRA’s scope under Article 2(6), expressly including spare parts for products made available before the deadline (recital 29). According to the guidance, “identical” does not necessarily require the same chipset or the same firmware version: differences that do not change the cybersecurity-relevant characteristics or the risk profile do not automatically exclude the exemption (para. 99, example 38). Conversely, it is not enough that a part has the same form factor or is interchangeable: what matters are the cybersecurity-relevant characteristics and the specific intended use of the replacement part. This can also cover a complete replacement PLC where it replaces an identical PLC that is a component of a larger product and is expressly supplied for that product’s repair; the repair purpose must be apparent from the circumstances of the supply and be evidenced, the sales channel alone is not sufficient (paras. 97 and 102, example 39). A replacement chip with a different cryptographic implementation or a new secure boot mechanism, by contrast, is not identical; it is a CRA product in its own right whose compliance is assessed against its intended purpose, including compatibility with the legacy product (paras. 100 and 101, example 37).
• Spare parts: Is the repaired product substantially modified? Generally not by the replacement alone, even with a better-performing part (para. 95). The two questions have to be answered separately.
• Security and maintenance updates are generally not substantial modifications, provided they leave the intended purpose unchanged and do not introduce new or increased cybersecurity risks, for instance through new externally reachable interfaces or altered data flows (paras. 108–109).
• Activation of functions already assessed. The fact that a function was present in the architecture is not sufficient on its own. Only where the function and its risks were expressly covered in the original risk assessment together with their safeguards, and activating it changes neither compliance with Annex I nor the assessed intended purpose, can it be activated later without a substantial modification (para. 106, example 43). Conversely, a small convenience feature such as a persistent login can be a substantial modification if it introduces risks that were not assessed (para. 107, example 44). The decisive point is therefore not “new interface or function” but whether the change affects compliance with the essential requirements, for instance through unassessed risks, or alters the assessed intended purpose.

What can be a substantial modification, depending in each case on the actual effect on compliance and intended purpose:

• An industrial gateway placed on the market in 2026 receives a new radio module and a remote maintenance function in 2028. Communication interfaces and attack surface change considerably.
• A smart home hub that could previously only be controlled locally receives cloud-based remote control with user accounts and permanent internet access via a firmware upgrade. Remote control can introduce new or increased cybersecurity risks that were not considered in the original risk assessment. Whether the assessed intended purpose is also changed has to be examined separately.
• A measuring device sold before the deadline is retrofitted with a communication module and integrated into a central platform. A standalone product becomes a connected one with new data flows.

What matters is the technical effect of the change, not whether it is called an “update” or an “upgrade”, and not the version number. The modified version has to meet the CRA requirements; according to the guidance, the obligations of whoever carries out the modification are limited to the modified parts, provided the modification does not negatively affect the cybersecurity of the product as a whole, regardless of whether that is the original manufacturer or a third party (paras. 118, 119 and 124). How a release team assesses and documents the security implications of a change is described in our post on the CRA guidance under “Decision3,securitydelta” .

What the unit-based reading does not mean

In projects, the unit-based reading is sometimes misread as an “obligation to redesign”. That is not correct either:

• No automatic redesign. According to the guidance (paras. 33 to 36), models designed before the CRA can be placed on the market after the deadline without redesign, provided the manufacturer demonstrates through the cybersecurity risk assessment under Article 13(2) and the technical documentation that the product achieves an appropriate level of cybersecurity and meets the essential requirements. For products assessed under the procedures of Article 32(1), test results from the original design and development phase do not have to be produced retrospectively where the current risk assessment shows that the existing measures adequately address the risks (para. 38). Which current tests are required continues to depend on the risk profile and the applicable conformity assessment procedure; a current risk assessment and complete technical documentation remain required in any case.
• No shortcut on formalities. Every newly placed unit must be covered by the applicable conformity assessment and EU declaration of conformity and carry the CE marking. The assessment covers the product, not every serial number (paras. 37 to 39). Variants of the same product family can be assessed and documented together provided they share the same architecture, security-relevant design and intended purpose and are exposed to the same risks; where they differ, for instance in communication interfaces, software stack, update mechanism or remote connectivity, this must be reflected in the risk assessment and documentation (guidance, section 7.4, paras. 174 to 177). Vulnerability handling processes under Annex I Part II are required in addition (paras. 35 and 39).
• No sales stop for goods already in the channel. Units placed on the market before the deadline may continue to be made available. Distributors do not have to bring them into compliance retroactively, unless they substantially modify them (CRA FAQ, section 7.5).
• Existing certificates retain limited validity. EU type-examination certificates and approval decisions regarding cybersecurity requirements under other harmonisation legislation, such as the Delegated Regulation under the Radio Equipment Directive, can according to the guidance be relied on for CRA purposes until 11 June 2028 at the latest, unless they expire earlier (Article 69(1)). Their validity under the other legislation is a separate matter. For units placed on the market until then, the risks covered by those certificates do not have to be reassessed for CRA purposes (guidance, paras. 248 to 252). The risk assessment under Article 13(2) nevertheless remains required in full; uncovered risks and all other obligations apply without restriction.
• No exemption from reporting obligations. For all products in scope, including legacy units, the Article 14 reporting obligations for actively exploited vulnerabilities and severe incidents have applied since 11 September 2026. The Regulation says so expressly: “By way of derogation from paragraph 2 of this Article, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027” (Article 69(3)). Under Article 14(8) this includes informing the impacted users about the vulnerability or incident and about mitigation measures. The deadlines start when the manufacturer becomes aware, that is, once an initial assessment establishes with reasonable certainty that a vulnerability is actively exploited or a severe incident has occurred, and unlike vulnerability handling, the reporting obligations continue after the support period has ended. Indications of a potentially notifiable event must be assessed immediately; the initial assessment must not be used to artificially delay the start of the deadlines, and in clear cases awareness exists from the outset (guidance, paras. 210, 211, 213 and 214). The earlier application date of Article 14 does not mean that the vulnerability handling obligations under Article 13 and Annex I Part II also apply to legacy units.

How reliable is this interpretation?

The Commission documents support this interpretation but are not legally binding; the FAQ explicitly state that they do not represent the Commission’s official position. National courts apply EU law in individual cases; the Court of Justice of the European Union ensures its uniform interpretation. We are not aware of any CJEU ruling on the CRA to date. The wording, the structure of the regulation and the long-established interpretation of the same concepts in the Blue Guide, which applies across NLF harmonisation legislation, all point in the same direction. The three documents are not three independent confirmations, however, but the consistent position of a single institution. Basing product planning on the model-based reading carries considerable risk when dealing with market surveillance authorities. In Germany, the BSI is the market surveillance authority for the CRA; the Bundestag passed the implementing act on 14 October 2026.

Edge cases can only be assessed on the specific facts, for example supply contracts concluded before the deadline but fulfilled afterwards, consignment stock, the delineation of software variants, or the question of when many small software changes add up to a substantial one. A legal review is advisable here.

Checking legacy products: the transition test and next steps

For a physical product with digital elements that falls within the CRA’s scope and is not exempt under Article 2, the transition question can be put per unit as follows:

Was this completed unit first made available on the Union market before 11 December 2027, that is, supplied for distribution or use by an offer or agreement on the transfer of ownership, possession or any other right? Storage location and physical delivery are not decisive on their own.

• Yes: legacy unit. The CRA only applies in the event of a substantial modification; the Article 14 reporting obligations already apply.
• No: the CRA requirements apply as soon as this unit is placed on the Union market from the deadline onward, regardless of how long the model has been on the market. Units that remain in stock or are supplied exclusively outside the EU do not trigger the CRA; identical spare parts remain exempt under Article 2(6).

This results in six steps for planning up to December 2027:

1. Review the portfolio: For which models are new units still to be placed on the market for the first time after 11 December 2027? For these, complete the CRA conformity assessment before the first placing after the deadline. For all other models, set the last date for first placing new units on the market. Downstream sales of units already placed on the market and the continued supply of unchanged software versions are unaffected by that date.
2. Set the support period per production batch: A support period under Article 13(8) CRA has to be set for every unit placed on the market after the deadline.
   • Criteria: The period must reflect the expected time in use, taking into account the criteria listed there (reasonable user expectations, the nature and intended purpose of the product, relevant Union law). The determination is a proportionate weighing and need not exactly match the expected time in use (CRA FAQ, section 4.5.1).
   • Minimum: Generally at least five years, but five years is not a default value. A longer period is generally appropriate for products expected to be in use for longer; only a genuinely shorter expected use time permits a shorter one (guidance, paras. 125–126).
   • Later batches: For each batch placed on the market later, reassess whether the planned end of support is still sufficient and extend it where necessary; an existing end date that provides sufficient support for later batches can also cover them. A manufacturer that places further units of a batch introduced in 2028 on the market in 2030 needs a support period for those units as well, one that meets the criteria (CRA FAQ, section 4.5.3).
   • Planning: Check the last planned placing date, the support commitments of component suppliers and the budget for security updates; see also “Decision4,supportperiod” .
3. Align terminology: Internally, speak of “legacy units” rather than “legacy products”, or define the term explicitly, so that sales, product management and production mean the same thing.
4. Secure evidence: Keep suitable evidence of the first making available, such as order confirmations, invoices or delivery notes, and link it to the units concerned or to clearly delimited batches. Manufacturing date and storage location alone do not prove a placing on the market.
5. Risk assessment for models still being offered: For models whose new units will first be placed on the Union market on or after 11 December 2027, prepare a current cybersecurity risk assessment and check whether the existing measures meet the requirements of Annex I. A product-specific threatandriskassessment provides the methodology; an embeddedsecurityassessment shows whether the measures are actually effective in the device.
6. Reporting and user information process for all delivered products: Make sure the PSIRT process also covers legacy units, including informing impacted users under Article 14(8), as the reporting obligations have applied to them since September 2026.

If you would like to clarify which of your models will still have new units placed on the market after the deadline and which technical evidence needs to be in place before the first placing on the market after the deadline, we are happy to support you with risk assessment and technical testing. On request, the legal assessment of applicability is handled by a lawyer specialising in IT and cyber regulation with whom we work; details are available on our CRApage . Scheduleafreeinitialconsultation to plan the next steps for your portfolio together.

Frequently asked questions on legacy products under the CRA

Many thanks to attorney Jörg Uzarek of uzarek.legal for the exchange and discussions on this topic.

This post is a subject-matter assessment based on the regulation and the European Commission’s interpretative documents (as of November 2026). It does not constitute legal advice and does not replace a legal review of individual cases.

Sources

• Regulation(EU)2024/2847(CyberResilienceAct),inparticularArticle2(6),Article3points(21),(22)and(30),Articles21and22,andArticle69
• EuropeanCommission:The‘BlueGuide’ontheimplementationofEUproductrules2022,Commissionnotice2022/C247/01,OJC247of29June2022,sections2.2and2.3
• EuropeanCommission:CyberResilienceActImplementation–FrequentlyAskedQuestions,version1.4of4September2026,sections1.4,4.5,5.3,6.4,7.2and7.5
• EuropeanCommission:GuidanceontheapplicationoftheCyberResilienceAct,C(2026)5252,27July2026,paras.10to15,33to39,90to107,114to126,174to177,210to214and247to252