Substantial modification means a change to a product that is significant enough to alter how the product is assessed, supported, or regulated. In cyber security and compliance work, the key question is not just whether code changed, but whether the change affects security properties, intended use, distribution, or responsibility for the product.
This matters because a major fork, firmware rewrite, embedded component replacement, or heavily customized deployment can move a product into a different compliance category. Security teams use change logs, release records, and ownership tracking to decide whether a modification is routine maintenance or a material transformation. Attackers may exploit poorly tracked modifications to hide unauthorized changes, while defenders rely on clear classification to trigger reviews, re-testing, and reporting duties when a product’s risk profile changes.