CRA Article 14 after the support period ends: do you still report?

Two different CRA clocks

Article 13(8) tells manufacturers to set a support period that reflects how long the product is expected to be in use — taking into account reasonable user expectations, the nature of the product, and related factors — with a floor of five years unless expected use is shorter. During that period, Annex I Part II vulnerability handling applies. Users must be able to see when support ends.

Article 14 does something else. Once you become aware of an actively exploited vulnerability contained in the product, or of a severe incident with impact on its security, you notify the coordinating CSIRT and ENISA through the Single Reporting Platform: early warning within 24 hours, fuller notification within 72 hours, then the final report on its own trigger. Nothing in Article 14 says those duties run only “during the support period.”

Why end-of-support does not cancel the SRP chain

When support ends, the baseline commitment to keep handling vulnerabilities for that version under the support-period rules stops. Products can still sit in customer networks for years. If reliable evidence of malicious exploitation (Article 3(42)) or a severe incident under Article 14(5) lands after EOL, awareness still starts the Article 14 reporting deadlines. Record that awareness time the same way you would for a supported SKU — see when the 24-hour clock starts.

Article 14(8) still expects you to inform impacted users (and where appropriate all users) about the vulnerability or incident and any mitigation they can deploy. The CSIRT can step in if you do not. That user-notice duty is not written as a support-period exclusive either — see informing users under Article 14(8).

Legacy catalogue vs end of support

Many EOL SKUs are also “legacy” in the Article 69 sense: placed before 11 December 2027. Article 69(3) keeps Article 14 on those products from 11 September 2026 even where wider CRA conformity is still phased. Commission FAQ 5.3 adds that you may still have to notify when investigation is practically impossible — tooling gone, old builds unreproducible — without that alone recreating full vulnerability-handling duties. Full walkthrough: Article 14 for legacy products. End-of-support is an extra false comfort on top of that: even a post-2027 product that aged out of its declared support window is not automatically outside Article 14 while it remains an in-scope product on the Union market. Repair stock is a related trap: a true identical spare part under Article 2(6) is outside the CRA, but a non-identical replacement (new crypto, secure boot, access control) is usually a CRA product with its own Article 14 clock — see Article 14 for spare parts.

Final reports when you will not ship a patch

For an actively exploited vulnerability, Article 14(2)(c) times the final report from when a corrective or mitigating measure is available — not only from a signed security update. Isolation guidance, a configuration kill-switch, or a compensating control can open that 14-day window. Until such a measure exists, keep the early-warning and 72-hour stages honest and document what users can do. Severe-incident finals still run one month from the 72-hour notification under Article 14(4)(c). Practical close-out: the final report and final report checklist.

Application dates to keep straight

Article 71(2) brings Article 14 into application on 11 September 2026. Most of the manufacturer package that includes Article 13 and Annex I Part II — the home of the formal support-period machinery — applies from 11 December 2027. Do not wait for a CRA-mandated support-period declaration before treating Article 14 as live on products already made available on the Union market. Map who the manufacturer is for white-label lines (OEM/ODM) and which CSIRT end-point you use (which CSIRT), including for discontinued catalogues.

Questions people ask

Does Article 14 stop when our CRA support period ends?

No. Article 14 requires the manufacturer to notify actively exploited vulnerabilities and severe incidents it becomes aware of in the product with digital elements. That duty is not limited to the support period in Article 13(8). Ending security updates ends the baseline vulnerability-handling commitment for that period — it does not cancel the SRP reporting chain.

What is the support period actually for?

Article 13(8) requires manufacturers to determine a support period that reflects expected use time (at least five years unless expected use is shorter), during which they handle vulnerabilities in line with Annex I Part II. Users must be told the end date. That is a product-lifecycle / vulnerability-handling rule. Article 14 is a separate awareness-triggered reporting rule via ENISA’s Single Reporting Platform.

Our SKU is end-of-life and we will never ship another patch. What do we still file?

If you become aware of an actively exploited vulnerability or a severe incident with impact on that product’s security, the 24-hour early warning and 72-hour notification still run from awareness. The AEV final report is due no later than 14 days after a corrective or mitigating measure is available — a network workaround, configuration change, or other mitigation can start that clock even when a full security update will never ship. Severe-incident finals still run one month from the 72-hour notification. Article 14(8) still expects you to inform impacted users.

Is this the same as Article 69(3) legacy reporting?

Related, not identical. Article 69(3) keeps Article 14 on products placed before 11 December 2027. This page answers a different trap: assuming that once a declared support window expires, reporting stops. Neither Article 14 nor Article 69(3) writes a support-period cut-off into the reporting duty. See also our legacy-products guide for grandfathering vs reporting.

Do Article 13 support-period rules already apply today?

Article 14 reporting has applied from 11 September 2026 (Article 71(2)). The wider manufacturer conformity and Annex I vulnerability-handling package — including the Article 13(8) support-period machinery — applies from 11 December 2027 for most products. Teams that already publish commercial end-of-support dates should still treat Article 14 as live now for in-scope products on the Union market, whether or not a CRA-mandated support period has started.

Who still reports after EOL — brand, ODM, or importer?

Article 14 stays with the manufacturer of the product with digital elements. End of support does not move the filing duty to the importer or distributor. White-label / OEM-ODM and non-EU manufacturer guides cover who that manufacturer is and which CSIRT end-point you use.