Placing on the Market
CRA timing turns on a market act, not on the first date a model was designed. The important questions are when the product was first supplied on the Union market, whether later supply is only later distribution of that product, and whether a later change is a substantial modification.
Market terms
‘placing on the market’ means the first making available of a product with digital elements on the Union market;
Regulation (EU) 2024/2847, Article 3(21)
‘making available on the market’ means the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge;
Regulation (EU) 2024/2847, Article 3(22)
Placing on the market is the first supply of the product on the Union market. Making available on the market is wider. It also covers later supply for distribution or use after the first supply has already happened.
First supply
The first supply on the Union market is placing on the market.
Later supply
Later sale or distribution of the same product is making available on the market.
Held stock
Manufacturing, storing, or finishing a product is not enough unless it is supplied for distribution or use.
Price does not decide the question. A free product can still be made available on the market if the supply is part of a commercial activity. A product made only for the manufacturer's own use is different: it is not placed on the market merely because it exists.
Individual product date
As for ‘making available’, the concept of placing on the market refers to each individual product, not to a type of product, and whether it was manufactured as an individual unit or in series. Consequently, placing on the Union market can only happen once for each individual product across the EU and does not take place in each Member State. Even though a product model or type has been supplied before new Union harmonisation legislation laying down new mandatory requirements entered into force, individual units of the same model or type, which are placed on the market after the new requirements have become applicable, must comply with these new requirements.
The Blue Guide 2022, section 2.3
The Commission FAQ applies this point to the CRA. Earlier placement of one product type does not cover all later units of the same type. Each individual product needs its own market date.
This matters for stock and repeated imports. If a batch of router units was placed on the market before 11 December 2027, those units do not enter the full CRA regime merely because they reach final users later. A later batch of the same model placed on the Union market on or after 11 December 2027 is different.
Products placed before 11 December 2027
Products with digital elements that have been placed on the market before 11 December 2027 shall be subject to the requirements set out in this Regulation only if, from that date, those products are subject to a substantial modification.
Regulation (EU) 2024/2847, Article 69(2)
By way of derogation from paragraph 2 of this Article, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027.
Regulation (EU) 2024/2847, Article 69(3)
The transition rule protects products already placed on the market before 11 December 2027 from the full CRA requirements, unless they are substantially modified from that date. It does not protect new units placed on the market later.
Article 14 reporting is separate. It starts earlier and also applies to in-scope products that were placed on the market before 11 December 2027.
Manufacturers must report actively exploited vulnerabilities and severe incidents when Article 14 requires reporting.
Products placed on the market from this date need to meet the applicable CRA requirements before placement.
Products placed before 11 December 2027 must meet the full CRA requirements only if they are substantially modified from this date.
Software version dates
Standalone software supplied by download or remote access does not behave like warehouse stock. The draft Commission guidance says that a standalone software product is placed on the market when the software version is complete and is first supplied for distribution or use on the EU market in a commercial activity.
Later downloads of that same version are normally later making available of the same software product. A later version gets a new placing-on-the-market date when the version is a substantial modification.
Same software version
Later downloads normally follow the first market date for that version.
Substantial new version
A substantially modified version is treated as newly placed on the market.
This reading is for standalone software supplied digitally. If software is supplied on a physical medium, the physical product still matters. If software is needed for a hardware product to perform its functions, the hardware and software may form one product even if the software is downloaded later.
Substantial modification
‘substantial modification’ means a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I or which results in a modification to the intended purpose for which the product with digital elements has been assessed;
Regulation (EU) 2024/2847, Article 3(30)
The definition has two routes. A change can be substantial if it affects compliance with the product cybersecurity requirements in Annex I, Part I. It can also be substantial if it changes the intended purpose for which the product was assessed.
A repair, support action, bug fix, or security update is not substantial merely because it happens after sale. The key question is whether the change alters the assessed purpose or the cybersecurity risk and compliance picture.
- A security update that fixes a vulnerability and does not change intended purpose usually points away from substantial modification.
- A feature update that changes what the product is meant to do can be substantial.
- A small feature can matter if it adds a new interface, data flow, external dependency, or attack scenario that was not addressed before.
- A product placed before 11 December 2027 enters the full CRA regime if it is substantially modified from that date.
Responsibility after modification
Article 21 treats an importer or distributor as the manufacturer if it places the product on the market under its own name or trademark, or carries out a substantial modification of a product already placed on the market.
Article 22 applies the same logic more broadly. A person other than the manufacturer, importer, or distributor can be treated as the manufacturer if that person carries out a substantial modification and makes the modified product available on the market.
Common timing cases
The main question is whether the individual product was already placed on the Union market before 11 December 2027. Reaching the final user later does not by itself remove the transition treatment.
Stock already supplied for distribution or use on the Union market before full application can continue through the supply chain, subject to Article 14 and the substantial-modification trigger. Stock merely manufactured or held before that date is different if it was not yet supplied for distribution or use.
The same model does not have one permanent CRA market date. Later units placed on the Union market on or after 11 December 2027 need to meet the CRA even if earlier units of that model were placed before that date.
A non-substantial update does not normally create a new placing-on-the-market date. A substantial update does. The answer depends on whether the update affects CRA product compliance or changes the assessed intended purpose.
A later standalone software version is newly placed on the market when it is a substantial modification. A small version update that is not substantial normally keeps the market date of the earlier version.