CRA Article 14 for aviation and drones: EASA certification exclusion vs reporting

What Article 2(3) actually excludes

Article 2(1) brings in products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Article 2(3) then switches the CRA off for products certified in accordance with Regulation (EU) 2018/1139 on common rules in the field of civil aviation and establishing a European Union Aviation Safety Agency — the EASA Basic Regulation.

FAQ 2.1.1 explains the overlap: both regimes set rules for placing products on the market; the EASA Basic Regulation covers aeronautical products, parts and equipment (including software) and, since 2020, has integrated information-security aspects into certification specifications. On that basis, Article 2(3) exempts products certified under Regulation (EU) 2018/1139 from CRA applicability. Commission FAQ 1.9 lists the same aviation limb alongside MDR/IVDR, motor vehicles, marine equipment and the L-category delegated exclusion. For aerospace and UAS teams, the operational consequence for reporting is simple: no CRA application → no Article 14 manufacturer duty for that certified product.

Article 14 only runs inside CRA scope

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks presuppose a product that is in CRA scope. A product certified under Regulation (EU) 2018/1139 is not that product for CRA purposes. Do not open an SRP case “just in case” for an excluded certified unit and treat it as a substitute for EASA / Part 21 processes; the recipients and legal bases differ.

If you also place non-excluded products (or you are unsure which SKUs are certified under 2018/1139), keep the Article 14 reporting deadlines and becoming-aware rules ready for the in-scope lines. Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

The open-category drone and uncertified-component traps

Teams often assume “we are in aviation, so CRA never applies.” Article 2(3) follows certification under Regulation (EU) 2018/1139, not the aerospace letterhead. FAQ 2.1.1 is explicit that products within the EASA Basic Regulation's broader scope that are not certified under it — such as drones in the open category (the majority of leisure drone activities and low-risk commercial activities) — may be covered by the CRA if they are products with digital elements made available on the market. The same FAQ applies that logic to components intended for integration into certified products but not themselves certified under 2018/1139.

Inventory each marketed item: certification basis (or open / specific / certified UAS category), intended purpose, and whether the software or accessory is placed separately. A companion app or fleet backend that the shipped drone needs may still meet remote data processing under Article 3(2) even when a certified airframe in the same catalogue is excluded. White-label or dealer branding does not by itself create an Article 2(3) exclusion — see who is the manufacturer for brand-under-name lines that are still CRA products.

EASA cybersecurity is not Article 14

Excluded certified aviation products still sit under their sectoral EASA certification and information-security frameworks. Those filings and management-system duties go through the aviation authorities and processes those acts require — not through the CRA Single Reporting Platform to a coordinating CSIRT and ENISA under Article 14. Keep CRA tooling for in-scope open-category drones, uncertified components and accessory lines; keep EASA procedures for units certified under 2018/1139.

Personal data in a connected-aircraft or drone-fleet incident can still raise GDPR duties for whoever is the controller — CRA vs GDPR — and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Those regimes do not reopen CRA Article 14 for an Article 2(3)-excluded certified product. For the parallel MDR/IVDR, motor-vehicle and marine exclusion patterns, see Article 14 for medical devices, Article 14 for motor vehicles and Article 14 for marine equipment.

Questions people ask

Do certified aircraft and aeronautical products have a CRA Article 14 reporting duty?

Not when the product is certified under Regulation (EU) 2018/1139 (the EASA Basic Regulation). Article 2(3) of the CRA excludes those certified products from the CRA entirely. Commission FAQ 1.9 and FAQ 2.1.1 repeat the same point. No CRA scope means no Article 14 early warning, 72-hour notification or final report through ENISA’s Single Reporting Platform for that certified aeronautical product, part or equipment (including certified software).

Are drones outside the Cyber Resilience Act?

Only where they are certified under Regulation (EU) 2018/1139. FAQ 2.1.1 is explicit: products that fall within the EASA Basic Regulation’s scope but are not certified under it — such as drones in the open category (most leisure and low-risk commercial drone activities) — may still be covered by the CRA if they are products with digital elements made available on the market. For those in-scope drones, Article 14 runs from 11 September 2026 like any other CRA product.

What about components meant for certified aircraft?

FAQ 2.1.1 draws the same certified-vs-not line for components: where a component is intended for integration into a product certified under Regulation (EU) 2018/1139 but the component itself is not certified under that Regulation, it may still be a CRA product with digital elements when placed on the market. Article 14 can apply to that separately placed, uncertified component even when the certified airframe beside it is out.

If the product is out of CRA, what cybersecurity reporting still applies?

EASA certification and information-security requirements under the EASA Basic Regulation / Part 21 stack remain for products inside that regime. Those channels are not ENISA CRA Single Reporting Platform filings under Article 14. Matching words like “incident” or “vulnerability” across regimes does not merge the clocks. Confirm live aviation cybersecurity duties with counsel for your certification basis and market.

Does GDPR or NIS2 reopen Article 14 for a certified aircraft product?

No for CRA scope. FAQ 1.9 / Article 2(3) decide whether the CRA (including Article 14) applies to the product. Personal-data breach duties under GDPR and entity-level incident duties under NIS2 are separate regimes — they can still apply to the organisation even when the certified aeronautical product itself is outside the CRA. See our CRA vs GDPR and CRA vs NIS2 guides for the no-substitution framing.

What about medical devices, motor vehicles or marine equipment?

FAQ 1.9 lists further CRA exclusions: MDR/IVDR (Article 2(2)(a)–(b)), products to which Regulation (EU) 2019/2144 applies (motor vehicles), and equipment in Directive 2014/90/EU (marine). Same logic: if the CRA does not apply, Article 14 does not either. See our medical-devices, motor-vehicles and marine-equipment guides for those stacks; this page focuses on the aviation / drone certification question manufacturers search for most often in the aerospace and UAS stack.