EU Commission CRA guidance C(2026) 5252: what binds, what does not

On 27 July 2026 the European Commission published guidance on applying the Cyber Resilience Act (CRA), issued as Communication C(2026) 5252 with an annex. It is non-binding. The Commission's own page says so: "though non-binding," it gives companies "the clarity they need to prepare now." The law itself did not change, and no deadline moved.

What's affected

The guidance is aimed at manufacturers of products with digital elements, with microenterprises and SMEs named as the priority audience. It rests on Article 26 of the CRA, which tasks the Commission with issuing guidance. It includes 67 practical examples, use cases, flowcharts and diagrams, and it complements the Commission's technical FAQ.

Here is the split that matters, based on the Commission's page and an independent CRA tracking site:

Only the Court of Justice of the EU gives authoritative interpretations of EU law. The guidance reflects the Commission's reading of the text, but it does not bind courts, regulators or you.

What the guidance covers:

• Scope, including when remote data processing solutions fall within the CRA and when free and open-source software is covered. It also explains when the lighter regime for open-source software stewards applies.
• Substantial modification (Article 3(30)): a change after market placement that affects compliance with the Annex I essential requirements. A product that is substantially modified is treated as newly placed on the market and goes through conformity assessment again.
• Support period (Article 3(20)): the period during which the manufacturer must handle vulnerabilities and provide security updates. The CRA sets a minimum of five years, unless the product is expected to be in use for a shorter time.
• Reporting and awareness (Article 14): when a manufacturer "becomes aware," which starts the clock. The independent site describes the test as an initial assessment reaching a reasonable degree of certainty.

How to check if you're exposed

Run each product through five questions. Write the answers down, because an auditor or a customer will ask for them.

1. Is it a product with digital elements, or does it contain remote data processing that the guidance puts in scope?
2. Do you place it on the EU market as a manufacturer, or only supply open-source code outside a commercial activity?
3. What is its expected period of use, and therefore its support period? If you cannot state one, the five-year minimum is your default.
4. What was the last change after market placement, and did it touch an Annex I requirement? If so, treat it as a candidate substantial modification.
5. Who in your company would decide that you are "aware" of an actively exploited vulnerability, and how fast can they reach the reporting channel?

What to do now

1. Read C(2026) 5252 and its annex on the Commission's site, starting with the examples closest to your product type.
2. Record a support period for each product and publish it where customers can find it.
3. Write down your definition of awareness and who can declare it. The 24-hour early warning runs from that moment.
4. Work out where and how you would file the three reports, and who holds access. Reporting has applied since 11 September 2026.
5. Keep a change log that marks which releases touch security requirements, so you can answer the substantial modification question later.

How suppliers can prepare

• Be able to say what is in each release. A current inventory of your own components lets you decide quickly whether an exploited vulnerability affects you, which is the first step in the 24-hour clock.
• Set up an internal triage path that ends in a decision to report, with a deputy for weekends.
• Build the three report stages as templates: early warning at 24 hours, notification at 72 hours and a final report within 14 days of a fix.
• Map your products to the support period and to the guidance's open-source steward test if you publish open-source components.
• Do not wait for a harmonised standard to start. The presumption of conformity needs one, but the Annex I requirements apply either way.

Why it matters

Guidance tends to be read as law because it is detailed and official. This one is explicit that it is neither. It tells you how the Commission reads the text, which is useful, and it leaves your obligations exactly where the regulation put them.

The binding part with a date already in the past is reporting. If you ship software into the EU, the question for this quarter is whether you can notify within 24 hours, not whether the guidance is mandatory.

The Commission says further Article 26 guidance may follow, so treat this document as a first edition. It presents the guidance as part of its simplification agenda, alongside the Digital Omnibus published in November 2025. If your product resembles one of them, you now have a reasoned position to cite in your own technical file.

This post is a summary, not legal advice.

Try it yourself

Click through it at your own pace, or open it full screen.

Then pick one product, list its top ten components and note who would decide whether a new exploited vulnerability affects it.

Quick check

Sources

• European Commission: Commission publishes new guidance to support timely Cyber Resilience Act implementation
• cyberresilienceact.eu: Commission CRA application guidance published 27 July 2026