EU Cyber Resilience Act

Placing on the market, classification and conformity routes – EU Cyber Resilience Act

EU Cyber Resilience Act Art. 32(5): Open-source products in Annex III using any procedure

Manufacturers of free and open-source products in an Annex III category may use any Article 32(1) procedure, internal control included, provided the technical documentation is made public when the product is placed on the market.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Placing on the market, classification and conformity routes – EU Cyber Resilience Act

Art. 32(1) Choosing a conformity assessment procedure (default products)
Art. 32(2) Conformity assessment for important class I products
Art. 32(3) Conformity assessment for important class II products
Art. 32(4) Conformity assessment for critical products
Art. 6 Condition for making a product available on the market
Art. 7(1) Classifying a product as important (Annex III, class I or II)
Art. 8(1) Critical products and European cybersecurity certification

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All EU Cyber Resilience Act controls