Effect on products currently on the market, that are actively updated

Regulation cannot be enforced retroactively. I often get asked what will happen to products that are currently placed on the market, or will be placed on the market before all obligations take effect. As an example, telecommunications infrastructure, or industrial control systems, will often see significant changes or increase in features over their lifespan, while remaining on mostly the same hardware. Is there a clearly defined "minimum bar" for feature changes or updates that would bring a product into scope of the CRA obligations, even when it was originally placed on the market before the obligations took force?

added FAQproposed label

added transition label

There is a lot of text on "substantial changes" but an exact definition I guess will come either in horisontal standards or implementation guides. As long as the updates are only security updates, they can continue without a CE requirement. If they add new functionality they will have to comply with the CRA.

A related issue is if you have an old system with many components working together and you add a new product to that - can the new product be "downgraded" to communicate with the old systems that are less secure? It's not a spare part, but a new product.

I think there needs to be a focus on legacy - pre-CRA - systems and maintenance somewhere. There are many questions here, not really covered in the current CRA text.