Is my software update a substantial modification under the CRA?

Article 3(30) defines a substantial modification as a change after placing on the market which affects compliance with the Annex I Part I essential requirements, or results in a modification to the intended purpose the product was assessed for.^[1] Commission guidance C(2026) 5252 point 110 turns that into four questions a manufacturer can actually apply.^[4]

Does the update introduce new threat vectors, such as additional interfaces, communication channels, execution environments or external dependencies? Does it enable new attack scenarios? Does it change the likelihood of previously identified attack scenarios, for example by lowering the effort required to exploit them or weakening existing safeguards? Does it change their potential impact, including the scope of affected data or functions, or the ability to detect, contain or recover from an incident?

The negative branch is cumulative. All four must be negative and the assumptions and mitigation measures relied on in the risk assessment must remain valid and effective.

Point 107 is explicit that the assessment turns on the potential adverse impact on the product's cybersecurity risk profile rather than on the scale or complexity of the change.^[4] The guidance illustrates this in both directions.

Adding a persistent login feature that stores authentication tokens locally is a substantial modification, because it introduces risks of token theft, unauthorised access and session hijacking that the risk assessment never considered. A diagnostics feature that exports detailed logs is substantial where it results in sensitive operational data being stored unencrypted.

In the other direction, enabling automated control features that were present in the architecture but shipped disabled, and whose activation the risk assessment already covered together with its safeguards, is not a substantial modification. Neither is adding group messaging to a messaging application where the original risk assessment anticipated it.

Recital 39 and guidance point 108 treat security updates as generally not substantial modifications, because their purpose is to reduce risk.^[3][4] Tightening firewall rules, disabling unused ports, changing default password policies, making multi-factor authentication mandatory where it already existed, and disabling a deprecated cryptographic algorithm in favour of one already supported and assessed all fall inside the carve-out, even where the technical change is significant.

The carve-out is conditional. It falls away where the update alters the intended purpose or the dependency structure. Replacing local file encryption with a remote encryption service operated by the manufacturer is a substantial modification despite its security motive, because the product no longer does what it was assessed to do. So is swapping an internally managed key lifecycle for a third-party key management service, because it introduces new external interfaces and reliance not considered in the risk assessment.

A substantially modified product made available on the market is treated as a new product, and making it available is a new placing on the market.^[4] The original manufacturer stays the manufacturer, but a fresh conformity assessment is owed.

That assessment is proportionate. Existing documentation and test results may be reused for parts the modification did not touch, and a third-party assessment should focus on the modified parts.^[5] Where someone other than the original manufacturer carries out the modification, Article 22 makes them the manufacturer, and their Article 13 and 14 obligations extend only to the modified part where the change does not harm the product's cybersecurity as a whole.^[2]

The support period needs re-deriving rather than resetting. Each substantially modified version needs its own declared period under Article 13(8), but a substantial modification does not automatically reset or extend it. The question is whether the modification changed the factors that set the expected use time.