CRA Implementing Regulation

(3) When developing a product with digital elements, and in order to achieve their desired set of functionalities, manufacturers typically integrate into their own products with digital elements other components which are also products with digital elements and that can meet the technical description of a category of important or critical products. Pursuant to Cyber Resilience Act (CRA), a product with digital elements is subject to the conformity assessment procedures applicable to important or critical products with digital elements, if that product as a whole is an important or critical product as set out in Annexes III and IV to that Regulation. For example, integrating an embedded browser as a component of a news app for use in smartphones does not in itself render the news app subject to the conformity assessment procedure applicable to products with digital elements that have the core functionality of ‘standalone and embedded browsers’. Nonetheless, in accordance with Cyber Resilience Act (CRA), the manufacturer needs to ensure that the product with digital elements as a whole meets the essential cybersecurity requirements. Therefore, the manufacturer needs to evaluate the security of the whole product, considering, as appropriate, the security of the components or functionalities that are integrated into it. For example, in order for the manufacturer of a news app to demonstrate that its product with digital elements is in conformity with Cyber Resilience Act (CRA), that manufacturer is to demonstrate that the news app as a whole satisfies the applicable requirements, considering, as appropriate, the security of the embedded browser that is integrated into its app.