CRA substantial modification — review the change, not its label
A software update, customer adaptation or hardware change needs a factual review of its effect on the product and the original conformity basis.
Preserve the baseline
Identify the original product, intended purpose, release and security assessment. Record the proposed change, affected functions and risks, including whether it was foreseen in the initial assessment.
Review the consequences
Examine whether the change affects compliance with essential cybersecurity requirements or changes the intended purpose. Do not infer substantial modification merely from a major-version label or dismiss it because the code diff is small.
Decision and follow-up
Retain rationale, reviewer, evidence and required reassessment. Connect the decision to the changed release and customer deployment. If the facts are incomplete, keep review required rather than issuing a definitive legal classification.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.