Substantial modification
A modification to a product with digital elements, made after it has been placed on the market, that affects the product's compliance with the essential cybersecurity requirements in Annex I Part I, or that changes the intended purpose as declared by the manufacturer. A substantial modification triggers a new conformity assessment, effectively treating the modified product as a new product.
Source citations
Regulation text
Article 3(30) of Regulation (EU) 2024/2847 defines substantial modification as:
"a modification of the product with digital elements, occurring after that product has been placed on the market, that is not anticipated or planned by the manufacturer in the technical documentation, and as a result of which the compliance of the product with digital elements with the applicable essential cybersecurity requirements set out in Part I of Annex I is affected, or as a result of which the intended purpose for which the product with digital elements has been assessed is modified".
When does a modification trigger the substantial modification test?
The key question is whether the modification:
- Was not anticipated or planned by the manufacturer in the technical documentation; and either:
- Affects Annex I Part I compliance (security properties of the product); or
- Changes the intended purpose declared by the manufacturer
Important: planned modifications are not substantial
If the manufacturer has planned and documented the modification in advance (e.g. a modular product architecture that anticipates add-on components, or a software update framework that describes how new features will be added), that modification is not "substantial" under the CRA definition — it is within the scope of the original conformity assessment.
Who becomes the manufacturer?
Under Article 22, any person (other than the original manufacturer, importer, or distributor acting in their supply chain role) who carries out a substantial modification and then places the product on the market is treated as the manufacturer for the modified product (or for the affected part if the product is separable).
An importer or distributor who carries out a substantial modification is also treated as the manufacturer under Art. 21.
Practical examples
| Change | Substantial? | Reasoning |
|---|---|---|
| Security patch for a vulnerability | No | Expected maintenance activity |
| Adding a new network interface not in the original scope | Likely yes | Changes attack surface and Annex I Part I requirements |
| Rebranding only, no functional change | No | Does not affect security compliance |
| Adding a remote management capability not in the original product | Likely yes | Changes intended purpose and security properties |