What happened
On 27 July 2026 the Commission published Communication C(2026) 5252 with its guidance on the application of the Cyber Resilience Act under Article 26, after a public consultation on a draft. It clarifies when products fall in scope, including remote data processing and free and open-source software, what counts as a substantial modification, how support periods should be set and the reporting obligations, with 67 practical examples, flowcharts and graphs. The Commission calls it non-binding.
What it means for machine builders
Two chapters decide money for a machine builder. Substantial modification: a retrofit or a software upgrade on a machine already in the field can make it a new product under the CRA; the installed base is otherwise outside the product requirements (Article 69(2)), while the reporting duty applies to it (Article 69(3)). Support period: it must reflect the time the machine is expected to be in use. Industrial equipment is used for a long time. Compliance managers should read those two chapters this month and write down, product by product, the support period they will declare and the modification policy for after-sales.
Where Shield Lifecycle fits
Shield Lifecycle tracks each machine instance through its declared support period and records every modification, so the evidence for both chapters builds up over time instead of being reconstructed at audit. Shield Lifecycle
Official source European Commission, guidance on the Cyber Resilience Act, C(2026) 5252
Published 16 October 2026 by Edge SDN. A summary, not legal advice. Always check the official text for your case.