Yes according to the Commission Guidance. This leads to logical somersaults to tame the consequences for the support period and legacy products.
No according to the CRA itself. No logical somersaults needed!
The Commission Guidance assumes that a substantial modification of a product implies a "new placing" (sic!) of the product on the market. This assumption has unwanted consequences.
- A new placing on the market leads to a restart of the support period, which can lead to infinite support periods.
- Placing a legacy product on the market again forces the manufacturer to perform a full conformity assessment.
As manufacturers pushed back hard on these points in their feedback to the draft of the Guidance, the final Commission Guidance decreed - without any legal justification - that these consequences do not exist.
In the section A Substantial Modification Implies a New Placing on the Market, I refute the assumption of the Commission Guidance with the CRA and the Blue Guide. As I have learned in several discussions, many CRA experts prefer to tinker with the symptoms instead of fixing the root cause: the wrong assumption. Fortunately, it doesn't matter what they believe!
Even if my refutation is wrong, we can achieve the same results as the Commission Guidance - without doing logical somersaults. Just by following the law, we come up with a weaker implication: If a product is substantially modified, the manufacturer must update the conformity assessment. I show you in the section A Substantial Modification Implies Updating the Conformity Assessment how to avoid the unwanted consequences above. My running example will be a heat pump.
A Substantial Modification Implies a New Placing on the Market
In §115 and §116, the Commission Guidance "justifies" that a substantial modification implies a new placing on the market with Recital 41 of the CRA and Section 2.1 of the Blue Guide. Let us have a look at Recital 41 first.
This is just a clumsy way of saying: If a product is substantially modified, the manufacturer must redo the risk assessment for the parts affected by the substantial modification. Only the affected parts "undergo a new conformity assessment". This is fully in line with Article 13.3.
From the CRA, we can only deduce that a substantial modification leads to an update of the risk assessment. Let us now turn to section 2.1 of the Blue Guide. The Blue Guide defines substantial modification as the CRA in Article 3.30 and Recital 39 The Blue Guide defines the following implication.
A little bit further down, the Blue Guide explains what the consequences of considering a substantially modified product as a new product are.
In section 2.3, the Blue Guide defines and explains the term "placing on the market" in length. Still it uses "considered as a new product" and not "placing on the market" in conjunction with substantial modifications. Why is that? I am pretty sure that this is not by accident but on purpose. The authors of the Blue Guide understand that a product can only be placed on the market once and not twice. The authors of the Commission Guidance fail to understand this.
In summary, the Blue Guide does not imply in any way that "considered as a new product" leads to "a new placing on the market". Instead, it comes to the same conclusion as the CRA.
I can't see how the Commission Guidance can deduce that a substantial modification implies a new placing on the market. Even the term "new placing on the market" is paradoxical. According to its definition in Article 3.21, placing on the market is the first making available on the market. Hence, a product can be made available on the market multiple times, but it can only be placed on the market once.
Placing a product on the market has more severe consequences than making it available. The manufacturers understood these consequences and made their displeasure known in the comments to the draft of the Commission Guidance. The CRA expert group backpedalled and changed the Guidance in the right direction but with no or questionable justifications.
According to Article 13.8, the support period starts when the product is placed on the market. Therefore, if a substantially modified product is considered newly placed on the market, its support period will also start anew. This easily leads to an ever-growing support period as I pointed out in my newsletter No. 72: Commission Guidance on the CRA - Infinite Support Periods. The Commission Guidance acknowledges this.
This makes it easier to keep the original support period when the software of an embedded system like a machine or IoT device is substantially modified. The justification is roughly as follows: The CRA support period and hence the expected use time of the SoM doesn't change. The "durability of the hardware" is the limiting factor in calculating the remaining support period as explained in Example 54 of the Commission Guidance.
The outcome is certainly right. However, the CRA expert group must perform a couple of logical somersaults to arrive at this conclusion. It desperately wants the new placing on the market due to substantial modifications (§115 and §116), but doesn't want to face the consequences: ever-growing support periods. Hence, it simply decrees that the support period isn't "automatically [...] reset or even extended" (§133). What is the legal justification for all this?!
There is a second case, where the concept of "new placing on the market" leads to unwanted consequences: legacy products. According to Article 69.2, if a product is placed on the market before 11 December 2027 and substantially modified after that date, the product "shall be subject to the requirements set out in this Regulation".
According to Article 13.1, 13.2 and 13.4, a manufacturer must provide a full conformity assessment when placing a product on the market. Putting these Articles together with the Guidance's implication leads to the following reading of Article 69.2: If a legacy product is substantially modified after 11 December 2027, it shall be subject to a full CRA conformity assessment. Of course, the Commission Guidance doesn't want this consequence and decrees it away.
Again, this is the right outcome. But what is the legal justification for this?!
You might be wondering why I insist on a proper legal justification - although the Commission Guidance comes to the right results. Fairly simple: The intention of the CRA is to improve cybersecurity for all products with digital elements. The job of the market surveillance authorities is to enforce this intention. A fairly obvious way is to maximise the support periods and to bring all products including legacy products fully under the CRA as quickly as possible.
However, the Commission Guidance restricts the CRA's intention. If you do that, you better have strong arguments. The strongest argument is following the law. That's what we do in the next section.
A Substantial Modification Implies Updating the Conformity Assessment
The previous discussion should have made the answer to the crucial question clear: No, a substantial modification does not imply a new placing on the market. What does a substantial modification imply then?
This is a weaker implication than the one in the Commission Guidance. Nevertheless, it allows us to arrive at the same results for the support period (Examples 54-56 in §134 and §135) and for legacy products (§124) as the Commission Guidance - but without doing logical somersaults. And bonus, we stand on a solid legal foundation instead of quicksand.
A product is substantially modified, if the intended purpose or the risk of violating any of the product properties (Annex I.I) changes. The support period may be extended, if, for example, the manufacturer replaces the embedded computing platform of a PLC with a new one four years after placing the PLC on the market (Example 56 in §135). The user information (Annex II) may also change, as it contains the intended purpose, the support period and some instructions what the user must do to keep the product secure. In short, the manufacturer must only update those parts of the conformity assessment that are affected by the substantial modification.
Substantial Modifications and the Support Period
Enough legal sophistry! Let us put our weaker implication to the test in some concrete examples. Example 1 below resembles Examples 54 and 55 in §134 of the Commission Guidance.
Example 1: Substantial modification leaves support period unchanged
In May 2029, a manufacturer places a heat pump on the market with a support period of 15 years. The main board is equipped with a SoC and a WiFi module. The SoC powers the HMI and controller of the heat pump. The WiFi module connects the heat pump with the internet and enables OTA updates and remote support. The crucial components in determining the support period of the heat pump are the SoC and the WiFi module. Both have a CRA support period of 15 years.
The manufacturer releases a feature update every year. As each feature update includes major changes for the HMI, controller and the roughly 150 Linux packages, it constitutes a substantial modification. Only the software of the heat pump changes. As the SoC and WiFi module are still the same as in May 2029, their support periods remain unchanged and, hence, the support period of the heat pump remains unchanged as well. It still ends in May 2044.
Example 1 gives us the standard justification for keeping the support period of an embedded system unchanged. As long as the main electronic components (SoM, SoC, communication modules, etc.) stay the same, substantial modifications of the software have no effect on the support period of the whole product.
Example 2 extends the support period due to a substantial modification of the crucial electronics components. It resembles Example 56 in §135 of the Commission Guidance.
Example 2: Substantial modification extends support period
The manufacturer places another heat pump like the one from Example 1 on the market in June 2029. In September 2033, the main board fails. The manufacturer replaces the main board. As the new board contains newer versions of the SoC and WiFi module, the replacement constitutes a substantial modification. Both the SoC and the WiFi module have a support period of 15 years. As the crucial components can be used four years longer, the manufacturer must extend the support period from 15 to 19 years. The support period for the heat pump now ends in September 2048 instead of June 2044.
If the expected use time of the heat pump or parts of it like the insulation, water tank or ventilator is only 15 years, the manufacturer need not extend the support period. It can stick with the original support period of 15 years ending in June 2044. This argument is in line with Example 55, which gives "the physical durability of the machinery hardware and expected wear and tear" as one of the factors for determining the support period.
Did we need the paradoxical concept of "new placing on the market"? No, we didn't! Updating the conformity assessment includes updating the support period by default.
Substantial Modifications and Legacy Products
Let us see how the weaker implication holds up for legacy products that are substantially modified after 11 December 2027. This case is governed by Article 69.2.
Example 3: Substantial modifications of legacy products
The manufacturer places a heat pump (cf. Example 1) on the market in April 2027. In August 2028, it rolls out a feature update for the HMI, controller and operating system. This feature update is a substantial modification.
The heat pump satisfies Article 69.2 and is "subject to the requirements set out in this Regulation". In the case of a substantial modification, the CRA requires the manufacturer to update the conformity assessment.
As most manufacturers of default products, this manufacturer has never done a conformity assessment for cybersecurity. Hence, updating the conformity assessment amounts to a full assessment. If the manufacturer had already done a partial assessment, it would have to complete the missing parts and update the existing parts affected by the risk assessment.
Updating the conformity assessment ranges from changing a few relevant parts in an already existing assessment to doing a complete assessment. The weaker implication covers the whole range. There is absolutely no need for introducing the paradoxical concept of "new placing on the market" and then taking it mostly back (cf. §124) to achieve the desired outcome.