CRA FAQ

The CRA states in Article 7(1) that "the integration of a product with digital elements which has the core functionality of a product category set out in Annex III shall not in itself render the product in which it is integrated subject to the conformity assessment procedures referred to in Article 32(2) and (3)." Therefore, products do not automatically inherit the classification of an integrated component. Instead, it comes down to the intended core functionality.

Example: if an operating system, which is a type of product classified as important, is integrated into a product which provides functionality that is not classified as important (e.g., an alarm clock), then this particular product (the alarm clock) is not classified as important product. If the core functionality of the product itself however is an operating system and can be used as such, it qualifies as an important product.

The CRA Expert Group is a consultative body set up by the European Commission to provide it with advice and expertise during the implementation of the CRA. It is composed of 60 members which include:

• individual experts appointed in their personal capacities,
• industry representatives,
• trade and business associations,
• NGOs,
• member state authorities (plus the Norwegian Communications Authority), and
• ENISA.

Open source is particularly well represented, as the following open source organizations are members:

• the Apache Software Foundation,
• the Eclipse Foundation,
• OpenSSF, and
• the Sovereign Tech Agency.

As described in Article 9, the CRA Expert Group is consulted by the European Commission as it:

• prepares Guidance as described in Article 26,
• prepares the technical descriptions of the important and critical product categories described in Article 7 and Article 8, and listed in Annex III and Annex IV respectively, and
• undertakes preparatory work for the evaluation and review of the CRA.

In practice, the CRA Expert Group meets in plenary sessions 2-3 times a year. It has multiple work strands on specific topics, including one on open source, which meet on an ad-hoc basis. The agenda and minutes of the plenary sessions are public and are available on the CRA Expert Group's offical page. Draft regulation and guidance shared with the CRA Expert Group may not be shared publicly until it is officially published.

You can find an explainer on expert groups in general on the European Commission's website.