Independent information resource Product security · EU CRA
CRA standards, guidance and rulemaking / 07

CRA Implementing Acts Explained

Understand Cyber Resilience Act implementing acts, how they differ from delegated acts, where the CRA uses them and why implementing regulations can materially change compliance operations.

IN BRIEF

For companies, the practical rule is to identify the enabling CRA article and the implementing measure together. An implementing act can define technical detail that affects product classification, evidence or conformity work even though the main Regulation has not been amended. It should therefore be tracked as part of the binding regulatory baseline, not filed as general Commission guidance.

01 / 06

Implementing Acts Provide Uniform Conditions for CRA Implementation

Implementing acts are used where uniform conditions are needed to apply the CRA consistently across the Union. The CRA identifies the subjects for which the Commission may use these powers, while Article 62 establishes the committee procedure. This is different from a delegated act, which is used to supplement or amend specified non-essential elements of the legislative act.

  • Identify the enabling CRA provision.
  • Identify the implementing act.
  • Check the examination procedure where relevant.
  • Treat the final measure as binding legislation.
02 / 06

Technical Product Descriptions Are an Important CRA Example

Article 7(4) required the Commission to adopt an implementing act specifying technical descriptions of the class I and class II categories in Annex III and the critical-product categories in Annex IV. Commission Implementing Regulation (EU) 2025/2392 performs that role. It does not rewrite Annex III into a new list, but it provides technical descriptions used to apply the existing categories more consistently.

  • Use the Annex category and technical description together.
  • Do not confuse technical description with a new product class.
  • Review classification reasoning against the implementing regulation.
  • Track amendments to the implementing measure.
03 / 06

Common Specifications Are Adopted by Implementing Act

Article 27 permits common specifications to be established through implementing acts when its fallback conditions are met. These measures can create presumption of conformity for the Annex I requirements they cover. This makes implementing acts relevant not only to administrative detail but also to technical conformity strategies.

  • Monitor Article 27 common specifications.
  • Map covered Annex I requirements.
  • Assess conformity-route implications.
  • Track later harmonised-standard replacement.
04 / 06

Some Enforcement Measures Also Use Implementing Acts

The CRA uses implementing powers in additional contexts where Union-level uniform action is needed. For example, Article 56 provides a Union-level procedure for products presenting a significant cybersecurity risk and allows Commission implementing acts requiring corrective or restrictive measures in the circumstances defined by that Article. Companies should therefore monitor implementing acts beyond standards and classification alone.

  • Classification implementation.
  • Common specifications.
  • Union-level enforcement measures.
  • Other CRA provisions granting implementing powers.
05 / 06

An Implementing Regulation Is Not Just Guidance

A Commission implementing regulation published in the Official Journal is part of the binding legal framework. A company should not treat it like an FAQ or explanatory web page. Compliance matrices should cite the implementing act where it provides the technical or procedural rule being applied and should preserve the version relied on for the product decision.

  • Record the implementing act number.
  • Record the controlling article.
  • Record affected products or processes.
  • Track amendments and application dates.
06 / 06

Build Implementing Acts Into Regulatory Change Control

The regulatory watch process should detect new implementing acts, classify their subject, identify affected products and assign an owner. Classification measures may require product reviews, common specifications may change technical evidence and enforcement measures may require immediate action. The impact workflow should therefore be based on substance rather than the generic label implementing act.

  • Detect publication.
  • Classify subject matter.
  • Map affected products.
  • Assign action and deadline.
  • Retain closure evidence.
REFERENCE DESK

Official sources

Read the full legal text and Commission material for precise wording, qualifications and updates.

Editorial review: 26 September 2026. Regulatory material can change; follow the official sources for current guidance.