How will the Cyber Resilience Act affect Toradex Products available on the market?

Feature Requests
,
1

Hello,

Although Toradex is trying to direct us toward newer products by announcing the end of support for some of their existing modules, market demand does not necessarily align with this decision.
We actively use the Toradex VF50 module in 6-7 different products, and replacing these with newer modules at both PCB and software levels does not seem feasible in the short term.

I have attended several seminars on the EU Cyber Resilience Act (CRA), and I am aware that Toradex is also working on this topic.
Toradex typically emphasizes the responsibilities of their customers regarding the products they manufacture, but it appears that they are overlooking their own responsibilities under the CRA.

Given that the VF50 is no longer supported with up-to-date BSPs, I am wondering to what extent this aligns with the new CRA regulations.
Will Toradex reconsider these decisions after the CRA comes into force?
Or will the current situation where the VF50 is excluded from modern BSPs remain unchanged?

I am also curious whether Toradex has evaluated the CRA specifically from the perspective of its own product portfolio.

Thank you.

2

Hello @Fide

You’re raising a very valid point, and in fact this is exactly the reason behind the decision we brought forward the EOL of the Colibri VF50 to comply with the CRA. Maintaining this module with modern BSPs and long-term security updates is no longer feasible under the new requirements. For this reason, the lifecycle was shortened (by only one year) as communicated on the PCN,

as WinCE will reach end of life on May 31, 2028 and the EU Cyber Resilience Act (CRA) will take effect on December 11, 2027, Toradex is discontinuing the affected products to ensure compliance

Just to add a few words regarding the CRA context: this regulation affects the entire supply chain. It’s not something Toradex simply chooses to do, but an EU requirement that applies to everyone. It starts with our hardware suppliers, who must ensure their components can be made compliant (which is possible with newer parts and in many cases not older ones). Then Toradex has the same obligations at the module level, and finally these responsibilities extend to product manufacturers, all the way until the end product reaches the customer.

If you need anything else on CRA implications or planning next steps, I can suggest a call with your Sales account manager, or we can also bring some of our experts into the discussion.

hope this helps, feel free to reach out anytime to continue the discussion. maybe setting a call would be beneficial to discuss this topic

best regards
Max

3

Hi @Fide,

The CRA gives you some leeway how to treat products that you placed on the market before 11 December 2027.

Article 69.2 states: Products placed on the EU market before 11 December 2027 will have to comply fully with the CRA, if they are substantially modified after 11 December 2027.

Conversely, products placed on the EU market before 11 December 2027 do not have to comply with the CRA, if they are not substantially modified after 11 December 2027.

According to Article 3.30 and Blue Guide 2.1, a product is subject to a substantial modification, if

  • the intended purpose changes or
  • the modification increases the risk.

To keep your existing products out of the CRA’s reach, you must show that none of the conditions holds.

The intended purpose (what your machine or device is used for) is a concept well-known long before the CRA and can be determined easily. If a modification changes the intended purpose, it is substantial and your product is subject to the CRA. So, keep the intended purpose unchanged.

Regarding the second condition: You don’t have any legal obligation to determine the risk for products placed on the market before 11 December 2027. Consequently, you cannot know whether a modification increased the risk. The second condition is not applicable and hence void.

In short: As long as you keep the intended purpose unchanged, modifications to products, which have been placed on the market before 11 December 2027, cannot be substantial.

I think that Article 69.2 is a blatant but eventually ineffective attempt to force all products under the CRA. This definitely collides with the constitutional right of non-retroactivity of law derived from the more general right of legal certainty. There is a fairly good chance that it violates these rights.

To make a long story short: You should consult with expert lawyers to find out how you can keep improving products already in the field - without having to comply with the CRA. I gave you some hints how you could that. I don’t know whether they will work. That’s for courts to decide.

By the way, Toradex is only doing what every manufacturer - including you - should be doing. Manufacturers should look at their product portfolios and decide which products should be taken off the market and which should be kept on the market. It’s a tough business decision.

Cheers,
Burkhard

2 Likes