Source: OJ L 2024/2847, 20.11.2024Current language: EN
- Cyber resilience for products with digital elements
Basic legislative acts
- CRA regulation
Article 4 Free movement
Summary What does Article 4 of the CRA regulation say?
This article establishes the principle of free movement for compliant products with digital elements across the EU, while carving out limited, clearly-labelled exceptions for non-compliant products in specific scenarios such as trade events and software testing.
It places obligations on Member States not to obstruct the internal market, effectively acting as a market access guarantee that complements the core requirements laid down elsewhere in the regulation.
Important points:
- Member States shall not block compliant products with digital elements from being made available on the market.
- Non-compliant products may be displayed at trade fairs or used for limited-period software testing, but must carry a visible sign indicating non-compliance and must not be placed on the market until compliant.
- The testing exception for unfinished software does not apply to safety components as defined under other Union harmonisation legislation.
Springlex's summary of the article is a reading aid, not a substitute for the legal text.
Member States shall not impede, for the matters covered by this Regulation, the making available on the market of products with digital elements which comply with this Regulation.
At trade fairs, exhibitions, demonstrations or similar events, Member States shall not prevent the presentation or use of a product with digital elements which does not comply with this Regulation, including its prototypes, provided that the product is presented with a visible sign clearly indicating that it does not comply with this Regulation and that it is not to be made available on the market until it does so.
Member States shall not prevent the making available on the market of unfinished software which does not comply with this Regulation, provided that the software is made available only for a limited period required for testing purposes with a visible sign clearly indicating that it does not comply with this Regulation and that it will not be available on the market for purposes other than testing.
Paragraph 3 does not apply to safety components as referred to in Union harmonisation legislation other than this Regulation.
Relevant recitals
Recital 37 Allowing for beta versions to be released
In order to ensure that manufacturers can release software for testing purposes before subjecting their products with digital elements to conformity assessment, Member States should not prevent the making available of unfinished software, such as alpha versions, beta versions or release candidates, provided that the unfinished software is made available only for the time necessary to test it and gather feedback. Manufacturers should ensure that software made available under those conditions is released only following a risk assessment and that it complies to the extent possible with the security requirements relating to the properties of products with digital elements laid down in this Regulation. Manufacturers should also implement the vulnerability handling requirements to the extent possible. Manufacturers should not force users to upgrade to versions only released for testing purposes.
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
vulnerability
Definition
component
Definition
cyber threat
Definition
cybersecurity
Definition
manufacturer
Definition
making available on the market
Definition
Union harmonisation legislation
Definition
product with digital elements
Definition
conformity assessment
Definition
remote data processing
Definition
electronic information system
Definition
hardware
Definition
software