The CRA allows for a common assessment of a family of products that share the same architecture, security design and risk profile

The CRA allows us to group products into families, but it is important to bear in mind that the same design and security considerations must be maintained.

This infographic explains how to apply the CRA when a manufacturer markets complex industrial systems with different hardware, firmware, software or connectivity configurations. A common assessment and set of documentation can cover several variants if they share the same architecture, security design, intended purpose and risk profile. However, each configuration must be identified and traceable: when a difference affects the risk profile, data flows, privileges or security measures, the assessment, technical documentation and applicable testing will need to be extended accordingly.
Another way of looking at it is that, if you have several products and carry out the risk assessment and prepare the documentation based on the most complex product with the largest attack surface, it will be easier to reuse that work for simpler products within the same family that share components.

For example, if you market several 3D printers and one offers Wi-Fi, Ethernet and USB connectivity, while other versions only offer USB connectivity, the versions with fewer connectivity options can use the documentation prepared for the more complex machine. The technical documentation would simply need to specify that those functions are not available in the simpler versions.
When preparing for the CRA, starting with the product that has the largest attack surface allows much of the supporting evidence to be reused, provided that it can be demonstrated that this evidence fully covers the risks and requirements of each variant within the product family.