Skip to main content

Clause 6.2 — Product context

Subclause 6.2 specifies requirements to establish and document product context under FprEN 40000-1-2:2026 and BSI TR-03183-1 Section 5.7. Product context forms the foundation for risk assessment and risk treatment.

Portal UI Path: CRA compliance → Products → [Select Product] → Context and risk → Product context (Clause 6.2)

Related Procedure: SOP-02: Taking a Product Through CRA Compliance

What Clause 6.2 requires​

Requirements​

  • [RMA-01-RQ-01]: Identify and document the product context:
    • Intended purpose and reasonably foreseeable use.
    • Reasonably foreseeable misuse (Annex II: record where this creates a significant security risk).
    • Product boundaries (what belongs to the product and what is external).
    • Operational environment of use (networks, physical surroundings, deployment context).
    • User capabilities (layman, instructed, skilled, mixed).
    • Product interfaces and communication restrictions (physical, local, dedicated known network, known network, external network).
  • [RMA-01-RQ-02]: If the product uses a Remote Data Processing Solution (RDPS), include the RDPS in the product context.

Outputs and Assessment​

  • Output: Documented product context containing all required context elements (C6.2-OUT-01).
  • Assessment Criteria: PASS assigned when product context exists, contains all required elements, and matches the product scope.

How CVD Portal supports compliance​

CVD Portal provides structured data inputs and an artifact repository in the product Context and risk tab:

  • Structured context data: Capture intended purpose, foreseeable use, foreseeable misuse, product boundaries, and operational environment as discrete fields.
  • User capability selection: Select from standard skill levels (Layman, Instructed, Skilled, Mixed) aligned with BSI TR-03183-1 Table 7.
  • Access restriction selection: Select who can get to the product itself (Restricted, Public and supervised, Public and movable, Not restricted), aligned with BSI TR-03183-1 Table 12. The BSI baseline rule for local attacks reads it.
  • Access restriction from a document: When you import a manual or an evidence document, the AI proposes the access restriction only if the document states where the product is installed or used. The proposal keeps that statement as a quote, which shows under the field. A private home or a locked plant room is "Restricted", as in the worked example of TR-03183-1 Annex C. An import fills the field only when it is empty, and it never replaces a value that you picked. When you pick a value, the quote goes away.
  • Foreseeable use and misuse proposals: These two fields are your own analysis, and a product document rarely states them. When you import a document, the AI proposes both from the product type, its interfaces, its users and where it is used, and fills a field only when it is empty. You can also select Suggest beside either field at any time. A proposal shows the note "The AI proposed this from the product facts". Select Accept, or edit the text, to make it yours. Until then, the C6.2-OUT-01 draft and the technical documentation export mark it as an AI proposal that the manufacturer has not reviewed.
  • Why a field is empty: Each empty field and each empty C6.2-IN box shows one sentence that gives the cause and the next step. For example, the document does not state it, no document has been analysed, the AI was not available during the analysis, or the box waits on the Remote data processing decision.
  • Interface inventory: Add physical, local, and network interfaces with specific access restrictions (Physical, Local, Dedicated known network, Known network, External network) aligned with BSI TR-03183-1 Table 5.
  • Read-only parameter links: View established support periods (Article 13(8)) and RDPS determinations (Article 3(2)) directly in context.
  • Clause 6.2 boxes from a document: When you confirm an analysed document, the analyzer drafts C6.2-IN-01 (use cases), C6.2-IN-02 (users), C6.2-IN-04 (boundaries, interfaces and remote services) and C6.2-IN-05 (functions) from the product facts it read. It fills only empty boxes and boxes it drafted before. A document never fills C6.2-IN-03 (market and state of the art). The Remote data processing decision writes C6.2-IN-06. Fill the assessment reads more of the document, so it can replace an analyzer draft. It never replaces text that you wrote.
  • Automated drafting and export: Structured fields flow directly into the C6.2-OUT-01 drafting prompt and the Annex VII technical documentation export.