{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-11-20","gaps":[],"covered":["CRA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/cra/articles/5","url":"https://www.headlesslaw.com/cra/articles/5","title":"Article 5 — Procurement or use of products with digital elements","family":"l1_generated","work_id":"cra","status":"not_yet_applicable","force_status":"in_force","date_state":"not_yet_applicable","requested_date":null,"as_of":"2026-11-02","applies_from":"2027-12-11","application":{"state":"not_yet_applicable","next":"2027-12-11","dates":[{"at":"2027-12-11","note":"Article 71(2)"}]},"version_label":"Consolidated version of 20 November 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120","valid_from":"2024-11-20","valid_until":"2027-12-11","revision":1,"content_id":"3f024aea263717b2","change_date":null,"nearest_versions":["2024-11-20"],"first_text_date":"2024-10-23","correction_applies":false,"versions":["2024-11-20"],"version_url":"https://www.headlesslaw.com/cra/articles/5/versions/2024-11-20","revision_url":"https://www.headlesslaw.com/cra/articles/5/versions/2024-11-20/rev/3f024aea263717b2","versions_url":"https://www.headlesslaw.com/cra/articles/5/versions","relations_url":"https://www.headlesslaw.com/cra/articles/5/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/cra/articles/5.md","body_sha256":"080e051cc976bd815548eca1127c532d4ecbf2c767c5dac886661dcf5f18f529"},"units":[{"locator":"cra/art/5","kind":"article","status":"in_force","label":null,"heading":"Procurement or use of products with digital elements","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"cra/art/5/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"This Regulation shall not prevent Member States from subjecting products with digital elements to additional cybersecurity requirements for the procurement or use of those products for specific purposes, including where those products are procured or used for national security or defence purposes, provided that such requirements are consistent with Member States’ obligations laid down in Union law and that they are necessary and proportionate for the achievement of those purposes.","marks":[],"revision":1,"text_hash":"a7771ac72119190e963debc9b92e834116d42de20cfc5178ac1bd246d0c14c50","reason":null},{"locator":"cra/art/5/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"Without prejudice to Directives 2014/24/EU and 2014/25/EU, where products with digital elements that fall within the scope of this Regulation are procured, Member States shall ensure that compliance with the essential cybersecurity requirements set out in Annex I to this Regulation, including the manufacturers’ ability to handle vulnerabilities effectively, are taken into consideration in the procurement process.","marks":[],"revision":1,"text_hash":"6bd178cf00979ee6ab41d423ba2b6fd3057b089c32f847154454b22ac70bc4df","reason":null}],"markdown":"---\ntitle: \"Article 5 — Procurement or use of products with digital elements\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120\"\nsource_retrieved: 2026-10-03\nshortTitle: \"Article 5 — Procurement or use of products with digital elements\"\ninstrument_type: level1_regulation\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Regulation (EU) 2024/2847\"\ninstrument: cra\ncelex: \"32024R2847\"\nregulation: CRA\nregulation-full: \"Regulation (EU) 2024/2847\"\narticle: 5\nstatus: in_force\nobject_id: eu.cra.legal_text.article.5\ntext_version: \"Consolidated version of 20 November 2024\"\nsource_url: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Consolidated version of 20 November 2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120)*\n\n1. <a id=\"p-1\"></a>This Regulation shall not prevent Member States from subjecting products with digital elements to additional [cybersecurity](https://www.headlesslaw.com/definitions/cra/cybersecurity) requirements for the procurement or use of those products for specific purposes, including where those products are procured or used for national security or defence purposes, provided that such requirements are consistent with Member States’ obligations laid down in Union law and that they are necessary and proportionate for the achievement of those purposes.\n2. <a id=\"p-2\"></a>Without prejudice to Directives 2014/24/EU and 2014/25/EU, where products with digital elements that fall within the scope of this Regulation are procured, Member States shall ensure that compliance with the essential cybersecurity requirements set out in Annex I to this Regulation, including the manufacturers’ ability to handle vulnerabilities effectively, are taken into consideration in the procurement process.\n\n***\n\n[Chapter II — Obligations of economic operators and provisions in relation to free and open-source software](../chapters/ii.md) · [← Article 4](4.md) · [Article 6 →](6.md)\n"}