CLAIM-2026-09-29-09
CRA Annex I, Part I, point (2) requires products with digital elements to be designed, developed and produced to limit attack surfaces including external interfaces, and to ensure that vulnerabilities can be addressed through security updates including automatic updates where applicable. Subpoint letters are not asserted: the archived rendering carries proposal-era lettering.
Why it matters
Annex I names external interfaces specifically. A local upgrade endpoint reachable by any page in the developer's browser is one.
Sources
- europeancyb2024annex