No. 71: Commission Guidance on the CRA - Placing on the Market
The CRA guidance treats placing on the market differently for standalone software and embedded systems. Longer support periods and workarounds cause higher costs for machine and device manufacturers. It would be simple to treat all products the same.
Read next
Fundamental Definitions of the Cyber Resilience Act
The definitions for making available on the market, placing on the market, intended purpose and substantial modification are crucial for understanding the CRA. The CRA, Blue Guide and Commission guidance interpret them differently. I am trying to sort out this mess.
Legal Disclaimers as CRA Mitigations
A device violates essential CRA requirements. Although simple state-of-the-art security measures are available, the manufacturer mitigates the violations with legal disclaimers. This goes against the intention of the CRA: improving cybersecurity in real life and not just on paper.