CRA Implementing Regulation

(5) On the other hand, a product with digital elements that has the ability to perform the functions of a product category set out in Annexes III and IV to Cyber Resilience Act (CRA) but whose core functionality itself is different from that of such product category is not to be considered to meet the technical description of that product category. For example, a security orchestration, automation and response (SOAR) software often has the ability to perform the functions of products with digital elements in the category of ‘security information and event management (SIEM) systems’, i.e. gather data, analyse it and present it as actionable information for security purposes. However, as its core functionality is not that of a SIEM, SOAR software are generally not to be considered to meet the technical description of ‘security information and event management (SIEM) systems’. Similarly, a smartphone typically integrates components that perform the functions of several product categories set out in Annexes III and IV to Cyber Resilience Act (CRA), such as an operating system or an integrated password manager. However, as a smartphone’s core functionality is not that of an operating system or of a password manager, it is generally not to be considered to meet the technical description of such product categories.