SkarpChapter 8 of 12
Answer a Product Surveillance Demand
Students will be able to organize a legally controlled response to a Cyber Resilience Act market-surveillance investigation.
1. Start with the date and legal basis
Date gate
On September 18, 2026, CRA reporting applies to actively exploited vulnerabilities and severe incidents affecting product security, but CRA market-surveillance rules generally do not apply until December 11, 2027.
Do not assume
Confirm the authority's actual legal basis, powers under national law, addressed entity, product, and deadline before treating a demand as compulsory.
2. Freeze the product under review
One product, not a family
Freeze the exact hardware revision, firmware build, application version, cloud dependency, markets, and sales period under review.
Worked distinction
If build 4.2.1 is exposed and 4.2.3 fixes it, show which units received each build and whether affected units can update.
3. Assemble a navigable technical-documentation room
Make evidence usable
Use a controlled index: document, owner, version, date, source location, relevance, and production status. An archive dump is not a defensible response.
Map to the request
Map each requested item to architecture, risk assessment, vulnerability handling, test evidence, declaration, and user instructions.
Handle gaps
State what is unavailable, why, who is recovering it, and when. Do not recreate a historical record as if it existed at the relevant time.
4. Give software access without giving away control
Necessary, not unlimited
First verify the applicable Union legislation and national power. Then match access to the compliance question; necessary software access does not automatically require unrestricted repository export.
Controlled access package
Provide a signed firmware image, manifest, read-only review environment, access log, and engineer able to explain build and test evidence.
5. Design the sampling protocol
Thought exercise: sampling without contamination
The authority asks to obtain three retail units of the access hub and says it may reverse-engineer them. Decide what your response team must preserve before the units leave control.
Your protocol should record serial number, firmware hash, packaging, purchase channel, chain of custody, photographs, and the unit's network state. Keep a matched retained unit where possible. Ask whether testing will occur offline, whether destructive testing is planned, and how the authority will identify the tested build.
Where Regulation (EU) 2019/1020 applies and the authority holds the applicable national power, Article 14 permits authorities to acquire samples, including under a cover identity, inspect them, and reverse-engineer them to identify non-compliance and obtain evidence.
6. Separate remediation from withdrawal and recall
Corrective action comes first
Under Article 54, non-compliance following evaluation first leads to appropriate corrective action. If adequate action is not taken, restriction, withdrawal, or recall may follow.
Union-wide execution
For affected products made available across the Union, plan corrective action across the Union, not solely in the Member State that made the request.
7. Submit a controlled response and preserve procedural rights
One controlled package
Submit scope, index, software-access plan, sample protocol, technical position, and corrective-action tracker as one reconciled response package.
Preserve review options
Keep the decision, evidence, submissions, reasons, remedy information, and receipt record. Cooperation and procedural discipline operate together.
Check understanding
Choose the most defensible response
A post-application CRA market-surveillance authority, holding the applicable power under national law, makes a reasoned request for access to embedded software to assess a specific firmware vulnerability. What should counsel do first?
Which response is most defensible?
- Refuse access because source code is always a trade secret.
- Confirm the legal basis, scope, and necessity of access, then offer a controlled, logged review environment with the relevant firmware and supporting build materials.
- Email the entire source-code repository immediately, without an access record, to demonstrate cooperation.
Show Answer
Answer: B) Confirm the legal basis, scope, and necessity of access, then offer a controlled, logged review environment with the relevant firmware and supporting build materials.
Confidentiality and trade-secret protections should be identified and preserved, but they do not displace a lawful and necessary access request. After confirming the legal basis and applicable national power, a scope-matched, controlled review gives the authority usable evidence while preserving security, confidentiality, and a reproducible disclosure record.
Key Terms
- Software access
- Necessary access to embedded software or related materials under an applicable legal basis and power, used by a market-surveillance authority to assess product compliance.
- Product sampling
- Authority acquisition and testing of product units, potentially including reverse engineering, under an applicable legal basis and supported by a documented chain of custody.
- Corrective action
- A risk- and evidence-based action to bring a product into compliance or eliminate or mitigate the relevant cybersecurity risk.
- Withdrawal and recall
- Restrictive product measures that remove products from distribution or seek their return from users when required corrective action is inadequate, unavailable, or itself entails those measures.
- Technical documentation
- The Article 31 and Annex VII evidence set showing how the product and the manufacturer's processes meet applicable CRA requirements.