Can manufacturers release non-compliant versions of software for testing?

“Member States shall not prevent the making available on the market of unfinished software which does not comply with this Regulation, provided that the software is made available only for a limited period required for testing purposes with a visible sign clearly indicating that it does not comply with this Regulation and that it will not be available on the market for purposes other than testing” (Article 4(3)).

Manufacturers can release non-compliant unfinished software for testing purposes, such as alpha versions, beta versions or release candidates, provided that that software is made available only for the time necessary to test it and gather feedback and that it is accompanied by a visible sign indicating its non-compliance.

Recital 37 further clarifies that “manufacturers should ensure that software made available under those conditions is released only following a risk assessment and that it complies to the extent possible with the security requirements relating to the properties of products with digital elements laid down in this Regulation. Manufacturers should also implement the vulnerability handling requirements to the extent possible. Manufacturers should not force users to upgrade to versions only released for testing purposes”.

© 2025 European Union • CC-BY 4.0 • “FAQs on the Cyber Resilience Act” p.11–12 (PDF) •
Disclaimer

Disclaimer: This document is prepared by the Commission services and should not be considered as representative of the European Commission’s official position. The replies to the FAQs do not extend in any way the rights and obligations deriving from applicable legislation nor introduce any additional requirement. The expressed views are not authoritative and cannot prejudge any future actions the European Commission may take, including potential positions before the Court of Justice of the European Union, which is competent to authoritatively interpret Union law.