> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/8.md). # Art. 8 — Critical products with digital elements CRA Article 8 — Critical products with digital elements. Regulation (EU) 2024/2847, Chapter II — Obligations of economic operators and provisions in relation to free and open-source software. 1. The Commission is empowered to adopt delegated acts in accordance with [Article 61](/cra/chapter-vi-delegated-powers-and-committee-procedure-art.-61-62/61.md) to supplement this Regulation to determine which products with digital elements that have the core functionality of a product category that is set out in Annex IV to this Regulation are to be required to obtain a European [cybersecurity](https://headlesslaw.com/definitions/cra/cybersecurity/) certificate at assurance level at least substantial under a European cybersecurity certification scheme adopted pursuant to Regulation (EU) 2019/881, to demonstrate conformity with the essential cybersecurity requirements set out in Annex I to this Regulation or parts thereof, provided that a European cybersecurity certification scheme covering those categories of products with digital elements has been adopted pursuant to Regulation (EU) 2019/881 and is available to manufacturers. Those delegated acts shall specify the required assurance level that shall be proportionate to the level of [cybersecurity risk](https://headlesslaw.com/definitions/cra/cybersecurity-risk/) associated with the products with digital elements and shall take account of their [intended purpose](https://headlesslaw.com/definitions/cra/intended-purpose/), including the critical dependency on them by essential entities as referred to in Article 3(1) of Directive (EU) 2022/2555. Before adopting such delegated acts, the Commission shall carry out an assessment of the potential market impact of the envisaged measures and shall carry out consultations with relevant stakeholders, including the European Cybersecurity Certification Group established under Regulation (EU) 2019/881. The assessment shall take into account the readiness and the capacity level of the Member States for the implementation of the relevant European cybersecurity certification scheme. Where no delegated acts as referred to in the first subparagraph of this paragraph have been adopted, products with digital elements which have the core functionality of a product category as set out in Annex IV shall be subject to the [conformity assessment](https://headlesslaw.com/definitions/cra/conformity-assessment/) procedures referred to in [Article 32(3)](/cra/chapter-iii-conformity-of-the-product-with-digital-elements-art.-27-34/32.md). The delegated acts referred to in the first subparagraph shall provide for a minimum transitional period of six months, unless a shorter transitional period is justified for imperative reasons of urgency. 2. The Commission is empowered to adopt delegated acts in accordance with [Article 61](/cra/chapter-vi-delegated-powers-and-committee-procedure-art.-61-62/61.md) to amend Annex IV by adding or withdrawing categories of critical products with digital elements. When determining such categories of critical products with digital elements and the required assurance level, in accordance with paragraph 1 of this Article, the Commission shall take into account the criteria referred to in [Article 7(2)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/7.md) and ensure that the categories of products with digital elements meet at least one of the following criteria: 1. there is a critical dependency of essential entities as referred to in Article 3 of Directive (EU) 2022/2555 on the category of products with digital elements; 2. incidents and exploited vulnerabilities concerning the category of products with digital elements could lead to serious disruptions of critical supply chains across the internal market. Before adopting such delegated acts, the Commission shall carry out an assessment of the type referred to in paragraph 1. The delegated acts referred to in the first subparagraph shall provide for a minimum transitional period of six months, unless a shorter transitional period is justified for imperative reasons of urgency. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/8.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.