Delegated acts are not informal guidance. When a CRA provision empowers the Commission to adopt one, the resulting measure can change the compliance framework within the limits set by the Regulation. Product teams should therefore map delegated-act powers to their portfolios and treat publication of a relevant act as a formal compliance-change trigger.
Delegated Acts Depend on a Specific Power in the CRA
The Commission cannot change the CRA through delegated legislation whenever it wishes. A delegated act must rely on a power granted by the Regulation and stay within that power. Article 61 sets the general rules for exercising the delegation, while individual CRA provisions define the subject matter that can be supplemented or amended.
- Identify the enabling CRA article.
- Identify what the Commission may amend or supplement.
- Check whether the adopted act stays within that scope.
- Record the resulting product impact.
Annex III Product Categories Can Be Changed by Delegated Act
Article 7(3) empowers the Commission to amend Annex III by adding a new important-product category, moving a category between class I and class II or withdrawing an existing category. The Commission must consider the cybersecurity-related functionality and risk criteria in Article 7. A product that is outside an Annex III category today can therefore require a different conformity route later if the Annex is amended.
- New category can be added.
- Category can move between class I and class II.
- Existing category can be withdrawn.
- Classification changes can alter conformity assessment obligations.
Annex IV and Critical-Product Certification Can Also Be Affected
Article 8 contains delegated powers concerning critical products. The Commission can supplement the CRA by determining which products with the core functionality of an Annex IV category must obtain a European cybersecurity certificate at an appropriate assurance level, subject to the statutory conditions. Article 8 also empowers the Commission to amend Annex IV by adding or withdrawing critical-product categories.
- Monitor Annex IV changes.
- Monitor certification-related delegated acts.
- Check assurance-level requirements.
- Assess effects on Article 32 conformity routes.
Delegated Acts Can Include Transition Periods
The CRA recognises that classification changes can require time to implement. Article 7 provides for a minimum transitional period of 12 months where appropriate for important-product category changes, subject to the Regulation's urgency exception. Article 8 contains its own transition rule for critical-product certification measures. Companies should therefore record both the publication date and the date when the new obligation begins to apply.
- Publication date.
- Entry into force.
- Transition period.
- Application date.
- Affected product releases.
Parliament and Council Scrutiny Is Part of the Delegated-Act Process
Article 61 provides the institutional framework for delegated acts, including the role of the European Parliament and the Council. Monitoring should therefore distinguish Commission adoption from the point at which the measure completes the applicable scrutiny process and takes legal effect. A draft or adopted measure can be important for planning before it is the operative compliance baseline.
- Track Commission adoption.
- Track scrutiny status.
- Track Official Journal publication.
- Implement against the legally effective text.
Delegated Regulations Should Enter the Compliance Change Register
A relevant delegated act should trigger a structured internal assessment. The company should identify affected product categories, conformity routes, certification requirements, technical documentation and transition dates. If no products are affected, the no-impact conclusion should still be recorded so future reviewers can see that the measure was assessed rather than missed.
- Affected products.
- Changed legal requirement.
- Transition timing.
- Owner and implementation action.
- Closure evidence.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.