The situation
A supplier fixes a parsing flaw without adding functionality. Testing supports the conclusion that the patch only reduces the identified risk. In a different release, the team claims no relevant change while its risk analysis identifies a new hazard; that inconsistency needs review.
Facts that change the answer
- Does the patch change assessed purpose or relevant compliance?
- Does testing support a risk-reducing change?
- Are the change conclusions consistent with the risk analysis?
Compare the worked results
These examples use the published assessment with the assumptions shown below. Change the facts in your own assessment before relying on its result.
Documented risk-reducing patch without changed purpose
Hypothetical example 1
Key facts in this example
- Effect on the nature or level of cybersecurity risk
- decreases risk only
All recorded assumptions (10)
- Product with digital elements
- Hypothetical example product
- Physical or software change being assessed
- Hypothetical security update to a supplied product
- The product was already placed on the Union market before this change
- Yes
- Person responsible for the change
- original manufacturer
- The modified product is made available on the Union market
- yes
- The change affects compliance with an applicable essential cybersecurity requirement
- no
- The change modifies the intended purpose for which the product’s conformity was assessed
- no
- The change and its cybersecurity effects were foreseen in the initial risk assessment
- yes
- Effect on the nature or level of cybersecurity risk
- decreases risk only
- The affected part of the product and any product-wide cybersecurity impact are documented
- Yes
Unchanged-compliance claim conflicts with increased risk
Hypothetical example 2
A recorded new or increased cybersecurity risk conflicts with the Article 3(30) answers. Reassess whether the change affects compliance with an essential requirement or the assessed intended purpose.(CRA recital 39; Commission 2026 guidance section 4.3)
Key facts in this example
- Effect on the nature or level of cybersecurity risk
- changes hazard or increases risk
All recorded assumptions (10)
- Product with digital elements
- Hypothetical example product
- Physical or software change being assessed
- Hypothetical security update to a supplied product
- The product was already placed on the Union market before this change
- Yes
- Person responsible for the change
- original manufacturer
- The modified product is made available on the Union market
- yes
- The change affects compliance with an applicable essential cybersecurity requirement
- no
- The change modifies the intended purpose for which the product’s conformity was assessed
- no
- The change and its cybersecurity effects were foreseen in the initial risk assessment
- yes
- Effect on the nature or level of cybersecurity risk
- changes hazard or increases risk
- The affected part of the product and any product-wide cybersecurity impact are documented
- Yes
Evaluated on 2026-09-13 using EU Cyber Resilience Act substantial-modification determination, version 2026.09.02. A completed example is not a customer Record or a declaration of conformity.
Evidence to keep
- Patch description and affected versions
- Regression and security test results
- Recorded compliance, purpose and risk-effect conclusions
Keep source artifacts in their controlled systems and record their references, responsible owner and review date with the decision.
Your next step
Keep the patch assessment with release evidence. Continue ordinary vulnerability handling even when the recorded facts do not establish a substantial modification.
Choose your real product or vulnerability case in the workspace. The selected assessment will be highlighted; example answers are not copied into your record.
Sources and application dates
- Regulation (EU) 2024/2847 (Cyber Resilience Act)Articles 3(30), 13, 14, 21 and 22; recitals 39–41
- European Commission CRA implementation guidance (2026)Section 4 — substantial modifications and their consequences
Manufacturer reporting applies from 11 September 2026. Broader product requirements apply from 11 December 2027; these product-readiness examples support preparation. Open-source-steward obligations have their own application date.
These examples structure a decision and do not replace the Regulation, official guidance or product-specific professional advice. Not lawyer-reviewed.