Using EUCC Evidence in CRA Conformity Assessment: What to Reuse and What to Review

An EUCC certificate or evaluation report may provide valuable evidence for a Cyber  Resilience Act conformity-assessment process—but it does not automatically  demonstrate conformity with the complete CRA. 

This practical guide helps manufacturers understand which EUCC evidence may be  relevant, what must be reviewed against the current product, and which CRA  responsibilities remain outside the scope of certification evidence. 

Complete the form to access the guide and assess how your EUCC certificate, Security  Target and evaluation evidence may support your CRA preparation. 

Understand the relationship between EUCC and the CRA 

The EU Cybersecurity Certification Scheme (EUCC) is based on Common Criteria and  applies to the evaluated Target of Evaluation, configuration, assumptions and security  claims defined in the relevant certificate and Security Target. 

For manufacturers, this means that EUCC evidence may support selected CRA  requirements or help prepare for a CRA conformity assessment. However, the certificate  must be compared with the specific product version placed on the EU market, its  configuration, interfaces, classification, risk assessment and applicable CRA obligations. 

The guide explains how to make this comparison in a structured and product-specific way. 

In this guide, you will learn how to: 

• distinguish between reusing evaluation evidence, claiming presumption of  conformity and using a certification-based CRA assessment route; 
• compare the EUCC Target of Evaluation with the product version placed on the EU  market; 
• review the relevance of the Security Target, architecture records, security-function  tests and vulnerability analysis; 
• identify how product changes, new interfaces, hardware revisions and remote  processing may affect evidence reuse; 
• document one decision for each relevant CRA requirement;
• identify remaining obligations relating to risk assessment, vulnerability handling,  SBOMs, support periods, user information and technical documentation;
• understand the importance of CRA Article 14 reporting responsibilities;
• prepare for change-impact analysis when a certified product is updated;
• consider the appropriate conformity-assessment route based on the product  category; and  create a practical gap list and evidence action plan. 

Who is this guide for? 

This guide is intended for: 

• manufacturers of products with digital elements; 
• product-security and cybersecurity managers; 
• Common Criteria and EUCC certification managers; 
• compliance and regulatory teams; 
• technical documentation owners; 
• software and embedded-product engineering teams; and 
• organisations preparing for CRA conformity assessment. 

It is particularly relevant to manufacturers that already have, or are considering, Common  Criteria or EUCC certification evidence for a connected, embedded or ICT product. 

Why this matters 

EUCC evidence can be useful, but its relevance depends on the exact product scope,  version, configuration, certificate conditions, supporting documentation and legal  framework applicable at the time. 

A certificate, evaluation report or test report is not, by itself, a CRA conformity certificate. It  does not automatically demonstrate conformity with every CRA obligation, including  lifecycle vulnerability handling, support-period decisions, reporting, user information,  production controls and technical documentation. 

A product-specific review can help manufacturers avoid two common risks: 

• assuming that existing certification evidence covers more than it actually does; and • overlooking CRA obligations that remain the manufacturer’s responsibility.