Substantial modification

The post-market change that brings conformity duties into play.

LAW Defined in Article 3 (Art. 3(30)). The verbatim definition is in the official text of Article 3; only the Official Journal is authentic.

BINDING Source: Regulation (EU) 2024/2847 (Cyber Resilience Act) · publisher European Union · captured 2026-09-16 · snapshot sha256:27b7c6c64c773001… · CELEX 32024R2847

A substantial modification is a change after placing on the market that affects compliance with the essential requirements or modifies the intended purpose F-014. It is the pivot of the transitional regime: products already on the market before full application owe conformity only upon substantial modification F-004, which makes classifying your changes an ongoing discipline rather than a one-time question F-105.

Rules of thumb

Recital 39, which is explanatory rather than operative, treats a security update that only lowers cybersecurity risk without changing the intended purpose as not a substantial modification, and a feature update that changes the intended functions and raises the risk as one. Document the assessment either way.

Verified facts this page relies on

F-014 Substantial modification: a change after placing on the market affecting compliance with essential requirements or resulting in a modification of the intended purpose; a person who substantially modifies a product becomes its manufacturer. Art. 3(30), Art. 22
F-105 For products already on the market, conformity is not required until substantial modification, but customers and distributors may ask for it; Article 14 applies regardless. Art. 69(2)–(3)
F-004 Products placed on the market before 11 December 2027 are subject to the Regulation only if substantially modified after that date; Article 14 applies to them regardless. Art. 69(2)–(3)

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Not sure whether this applies to your product? Check if the CRA applies to you on CRARequired.