Product modifications

Is every security patch a substantial CRA modification?

A patch is not automatically substantial. Record whether it affects essential-requirement compliance or changes the assessed intended purpose, and resolve conflicting risk evidence.

Prepared by CRA Operations · Updated 2026-09-13 · Hypothetical worked examples

The situation

A supplier fixes a parsing flaw without adding functionality. Testing supports the conclusion that the patch only reduces the identified risk. In a different release, the team claims no relevant change while its risk analysis identifies a new hazard; that inconsistency needs review.

Facts that change the answer

  • Does the patch change assessed purpose or relevant compliance?
  • Does testing support a risk-reducing change?
  • Are the change conclusions consistent with the risk analysis?

Compare the worked results

These examples use the published assessment with the assumptions shown below. Change the facts in your own assessment before relying on its result.

Documented risk-reducing patch without changed purpose

Hypothetical example 1

Assessment resultnot substantial on recorded facts
Key facts in this example
Effect on the nature or level of cybersecurity risk
decreases risk only
All recorded assumptions (10)
Product with digital elements
Hypothetical example product
Physical or software change being assessed
Hypothetical security update to a supplied product
The product was already placed on the Union market before this change
Yes
Person responsible for the change
original manufacturer
The modified product is made available on the Union market
yes
The change affects compliance with an applicable essential cybersecurity requirement
no
The change modifies the intended purpose for which the product’s conformity was assessed
no
The change and its cybersecurity effects were foreseen in the initial risk assessment
yes
Effect on the nature or level of cybersecurity risk
decreases risk only
The affected part of the product and any product-wide cybersecurity impact are documented
Yes

Unchanged-compliance claim conflicts with increased risk

Hypothetical example 2

Assessment resultprofessional review required

A recorded new or increased cybersecurity risk conflicts with the Article 3(30) answers. Reassess whether the change affects compliance with an essential requirement or the assessed intended purpose.(CRA recital 39; Commission 2026 guidance section 4.3)

Key facts in this example
Effect on the nature or level of cybersecurity risk
changes hazard or increases risk
All recorded assumptions (10)
Product with digital elements
Hypothetical example product
Physical or software change being assessed
Hypothetical security update to a supplied product
The product was already placed on the Union market before this change
Yes
Person responsible for the change
original manufacturer
The modified product is made available on the Union market
yes
The change affects compliance with an applicable essential cybersecurity requirement
no
The change modifies the intended purpose for which the product’s conformity was assessed
no
The change and its cybersecurity effects were foreseen in the initial risk assessment
yes
Effect on the nature or level of cybersecurity risk
changes hazard or increases risk
The affected part of the product and any product-wide cybersecurity impact are documented
Yes

Evaluated on 2026-09-13 using EU Cyber Resilience Act substantial-modification determination, version 2026.09.02. A completed example is not a customer Record or a declaration of conformity.

Evidence to keep

  • Patch description and affected versions
  • Regression and security test results
  • Recorded compliance, purpose and risk-effect conclusions

Keep source artifacts in their controlled systems and record their references, responsible owner and review date with the decision.

Your next step

Keep the patch assessment with release evidence. Continue ordinary vulnerability handling even when the recorded facts do not establish a substantial modification.

Choose your real product or vulnerability case in the workspace. The selected assessment will be highlighted; example answers are not copied into your record.

Sources and application dates

Manufacturer reporting applies from 11 September 2026. Broader product requirements apply from 11 December 2027; these product-readiness examples support preparation. Open-source-steward obligations have their own application date.

These examples structure a decision and do not replace the Regulation, official guidance or product-specific professional advice. Not lawyer-reviewed.

Related situations