Record a substantial-modification decision

A substantial modification makes the product a new one placed on the market: its conformity is assessed again for the parts that changed, and its support period is looked at again. Most updates are not one, and the Commission's guidance says so of security updates in particular. The ones that are deserve a written decision before anybody asks.

The factors below follow the Commission's guidance C(2026) 5252, which is not binding. The paragraph numbers shown are from a secondary reading of it and have not yet been checked against the Commission's text. The decision is yours.

Before you start

products.write permission.

Steps

1. Open the product and follow Modifications.
2. Name the change and, if it has shipped, the version.
3. Answer each factor Yes, No or Not sure:
   • Is it a security update? (¶108)
   • Does it change the intended purpose? (Art. 3(30))
   • Does it add interfaces, communication channels, execution environments or external dependencies? (¶110)
   • Does it make new ways of unauthorised access, manipulation, interference or misuse plausible? (¶110)
   • Does it make attack scenarios you already identified more likely? (¶110)
   • Does it increase their impact? (¶110)
4. Read the Indication. It updates as you answer and cites what it rests on. Any "Not sure" leaves it unclear on purpose.
5. Choose Substantial modification or Not substantial, write Why, and press Record the decision.

What you should see

The decision is listed with its date, who made it, the version and the indication shown at the time. It cannot be edited; a later change of mind is a new decision. A substantial one states what follows: a new placing on the market, a conformity assessment of the modified parts, the technical file and declaration drawn up again, and the support period reassessed (not reset automatically). Decisions appear in the product's technical file.

Related

• Record the essential requirements and risk assessment