Using EUCC Evidence in CRA Conformity Assessment: What to Reuse and What to Review

An EUCC certificate or evaluation report may provide valuable evidence for a Cyber Resilience Act conformity-assessment process - but it does not automatically demonstrate conformity with the complete CRA.

This practical guide helps manufacturers understand which EUCC evidence may be relevant, what must be reviewed against the current product, and which CRA responsibilities remain outside the scope of certification evidence.

Complete the form to access the guide and assess how your EUCC certificate, Security Target and evaluation evidence may support your CRA preparation.

Understand the relationship between EUCC and the CRA

The EU Cybersecurity Certification Scheme (EUCC) is based on Common Criteria and applies to the evaluated Target of Evaluation, configuration, assumptions and security claims defined in the relevant certificate and Security Target.

For manufacturers, this means that EUCC evidence may support selected CRA requirements or help prepare for a CRA conformity assessment. However, the certificate must be compared with the specific product version placed on the EU market, its configuration, interfaces, classification, risk assessment and applicable CRA obligations.

The guide explains how to make this comparison in a structured and product-specific way.

In this guide, you will learn how to:

• distinguish between reusing evaluation evidence, claiming presumption of conformity and using a certification-based CRA assessment route;

• compare the EUCC Target of Evaluation with the product version placed on the EU market;

• review the relevance of the Security Target, architecture records, security-function tests and vulnerability analysis;

• identify how product changes, new interfaces, hardware revisions and remote processing may affect evidence reuse;

• document one decision for each relevant CRA requirement;

• identify remaining obligations relating to risk assessment, vulnerability handling, SBOMs, support periods, user information and technical documentation;

• understand the importance of CRA Article 14 reporting responsibilities;

• prepare for change-impact analysis when a certified product is updated;

• consider the appropriate conformity-assessment route based on the product category; and

• create a practical gap list and evidence action plan.

Who is this guide for?

• manufacturers of products with digital elements;

• product-security and cybersecurity managers;

• Common Criteria and EUCC certification managers;

• compliance and regulatory teams;

• technical documentation owners;

• software and embedded-product engineering teams; and

• organizations preparing for CRA conformity assessment.

It is particularly relevant to manufacturers that already have, or are considering, Common Criteria or EUCC certification evidence for a connected, embedded or ICT product.

Why this matters 

EUCC evidence can be useful, but its relevance depends on the exact product scope, version, configuration, certificate conditions, supporting documentation and legal framework applicable at the time. A certificate, evaluation report or test report is not, by itself, a CRA conformity certificate. It does not automatically demonstrate conformity with every CRA obligation, including lifecycle vulnerability handling, support-period decisions, reporting, user information, production controls and technical documentation. A product-specific review can help manufacturers avoid two common risks:

• assuming that existing certification evidence covers more than it actually does; and

• overlooking CRA obligations that remain the manufacturer’s responsibility.

Assess how EUCC evidence can support your CRA preparation

Download the practical guide to understand what your EUCC certificate, Security Target and evaluation evidence may or may not demonstrate for CRA conformity assessment. Identify evidence gaps, remaining manufacturer responsibilities and the next steps for a product-specific review.

Download the EUCC and CRA Guide.