Substantial modification
A modification to a product with digital elements, made after it has been placed on the market, that affects the product's compliance with the essential cybersecurity requirements in Annex I Part I, or that changes the intended purpose as declared by the manufacturer. A substantial modification triggers a new conformity assessment, effectively treating the modified product as a new product.
Source citations
Regulation text
Article 3(30) of Regulation (EU) 2024/2847 defines substantial modification as:
"a modification of the product with digital elements, occurring after that product has been placed on the market, that is not anticipated or planned by the manufacturer in the technical documentation, and as a result of which the compliance of the product with digital elements with the applicable essential cybersecurity requirements set out in Part I of Annex I is affected, or as a result of which the intended purpose for which the product with digital elements has been assessed is modified".
When does a modification trigger the substantial modification test?
The key question is whether the modification:
- Was not anticipated or planned by the manufacturer in the technical documentation; and either:
- Affects Annex I Part I compliance (security properties of the product); or
- Changes the intended purpose declared by the manufacturer
Important: planned modifications are not substantial
If the manufacturer has planned and documented the modification in advance (e.g. a modular product architecture that anticipates add-on components, or a software update framework that describes how new features will be added), that modification is not "substantial" under the CRA definition — it is within the scope of the original conformity assessment.
Who becomes the manufacturer?
Under Article 22, any person (other than the original manufacturer, importer, or distributor acting in their supply chain role) who carries out a substantial modification and then places the product on the market is treated as the manufacturer for the modified product (or for the affected part if the product is separable).
An importer or distributor who carries out a substantial modification is also treated as the manufacturer under Art. 21.
Practical examples
| Change | Substantial? | Reasoning |
|---|---|---|
| Security patch for a vulnerability | No | Expected maintenance activity |
| Adding a new network interface not in the original scope | Likely yes | Changes attack surface and Annex I Part I requirements |
| Rebranding only, no functional change | No | Does not affect security compliance |
| Adding a remote management capability not in the original product | Likely yes | Changes intended purpose and security properties |
Physical repairs (Commission guidance § 4.1)
The Commission's guidance (C(2026) 5252, § 4.1) clarifies that refurbishment, maintenance, and repair operations that result in physical modifications do not necessarily amount to a substantial modification. A case-by-case assessment is still required: the question is whether the physical change affects compliance with the essential requirements, or changes the intended purpose covered by the cybersecurity risk assessment — the same two-part test used for any other modification.
Replacing a defective or worn part with one that performs better (e.g. because of technical progress, or because the original part is no longer produced) does not, by itself, trigger a substantial modification, unless the performance or behaviour change affects Annex I Part I compliance or the intended purpose.
Example (guidance § 4.1): A manufacturer repairs a computer server by swapping a defective RAM module for a newer, better-performing one. The server's compliance with the essential requirements is unaffected, and its improved performance remains within the intended use considered in the cybersecurity risk assessment — so the server is not substantially modified.
Spare parts (Commission guidance § 4.2)
Article 2(6) of the CRA exempts spare parts — intended to replace identical components and manufactured to the same specifications — from the CRA altogether. The guidance (§ 4.2) clarifies how to apply this exemption:
- It only applies where the part is specifically supplied to repair or extend the durability of a product with digital elements already placed on the market (whether that happened before or after 11 December 2027). A product supplied as a standalone item, with no connection to maintaining or repairing a pre-existing product, is placed on the market in its own right and is not a "spare part" for the purposes of Article 2(6) — even if it could technically be used as a replacement.
- The repair/maintenance purpose should be apparent from the context of supply (e.g. identified in the order or commercial offer, or supplied through after-sales/service channels), and supporting evidence should be kept available to market surveillance authorities.
- Whether a spare part is "identical" to the component it replaces turns on its functional role and cybersecurity-relevant characteristics — differences that don't affect security characteristics or the risk profile don't disqualify a part from the exemption. Differences in algorithms, protocols, cryptographic mechanisms, access-control features, or other security-relevant characteristics can mean the part is not identical.
- A spare part that is not identical to the original component is itself a product with digital elements and is subject to the CRA in its own right — compliance is then assessed against the replacement part's own intended purpose (e.g. ensuring compatibility with the existing product), with any unavoidable constraints reflected in the risk assessment and offset by compensating measures.
Example (guidance § 4.2): A manufacturer sells a replacement digital communication module for a connected controller, matching an identical failed module. This holds whether the original controller was placed on the market before the CRA applied (2026) or afterwards in CRA-compliant form (2028) — in both cases, an identical replacement module qualifies as an exempt spare part under Article 2(6).