CRA Article 14 for Data Act connected products: dual scope vs reporting

What FAQ 2.9 actually says

Commission FAQ 2.9.1: the CRA and the Data Act (DA) are essentially of a different nature. The CRA sets rules for making products with digital elements available on the market. The DA lays down rules for, among other things, making product data and related services data available to other entities. In certain cases both can attach to similar products: a CRA product with digital elements may also be a connected product or a related service within the meaning of the DA.

The FAQ's working example is a home appliance with hardware and software that connects to the internet for its functionality — a smart refrigerator that also collects use data and can communicate that product data via the Internet. That device may be a product with digital elements under the CRA and a connected product under the DA at the same time. That is dual-scope language, not an exclusion.

FAQ 2.9.2 ties the regimes together at risk assessment, not at reporting: where a CRA PDE may also face DA obligations to make data available to users or third parties (Articles 4 and 5 DA), the manufacturer must ensure those DA requirements are considered as part of the CRA cybersecurity risk assessment under Articles 6 and 13. The same answer reminds manufacturers that the DA also lets data holders restrict or refuse sharing in defined cases — the trade-secret and safety-and-security handbrakes (Articles 4(8) and 5(11), and Article 4(2), DA). Designing access controls or invoking a handbrake is still not an ENISA early warning.

FAQ 2.9.3 closes the calendar trap manufacturers invent: under the DA there is no strict redesign obligation if data-availability duties are met. Whilst the CRA is set to apply fully by 11 December 2027, and products placed before that date are only then subject to the CRA's cybersecurity requirements if substantially modified (Article 69(2)), reporting obligations, e.g. for actively exploited vulnerabilities, apply for all products with digital elements (Article 14). The FAQ points onwards to FAQ 1.4 on pre-11 December 2027 placements — the same legacy/reporting split covered in our legacy-products guide.

Article 14 clocks still attach inside CRA scope

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks attach when you are the manufacturer of an in-scope CRA product and awareness hits. They do not wait for a completed Data Act access architecture, a third-party data-share contract, a handbrake decision, or for 11 December 2027 Annex I application.

Keep the Article 14 reporting deadlines, becoming-aware and legacy-products guides ready for connected products already shipping use telemetry. Article 69(3) keeps reporting on in-scope products placed before 11 December 2027.

The trap: “we’re under the Data Act, so SRP can wait”

Product, IoT and data teams often copy the medical-device mental model: another Union act applies, therefore CRA (and Article 14) does not. For MDR/IVDR, vehicles, aviation and marine that can be true under Article 2. For the Data Act it is false. FAQ 2.9 is titled interplay, not exclusion — and FAQ 2.9.3 names Article 14 expressly while discussing DA redesign. A data-portability interface, user data export or third-party share under Articles 4/5 DA is not an ENISA SRP early warning.

Inventory each SKU for CRA connection and product definition first (firmware, companion app, cloud backend — see remote data processing). Then map who is the manufacturer under brand-under-name / OEM-ODM rules. Smart-home and appliance products that also face Data Act connected-product duties are often the same SKUs that sit under GPSR consumer-safety dual scope — see consumer products / GPSR.

Other regimes are not substitutes

Personal data in a connected-product incident can still raise GDPR duties (CRA vs GDPR), and some manufacturers also sit in NIS2 sectors (CRA vs NIS2), face AI Act Article 73 parallel tracks (CRA vs AI Act) or DORA Article 19 at the financial entity (CRA vs DORA). Civil compensation under the Product Liability Directive (FAQ 2.3.1) is another complementary track — not an SRP substitute. None of those replace an SRP filing for an in-scope manufacturer product. Connected machinery under the Machinery Regulation is another dual-scope pattern (machinery). For true CRA product-class exclusions, see medical devices, motor vehicles, aviation and drones, marine equipment, identical spare parts and national security and defence.

Questions people ask

Do Data Act connected products have a CRA Article 14 reporting duty?

Yes when the SKU is a product with digital elements inside CRA Article 2(1) / Article 3(1) and you are its manufacturer. Commission FAQ 2.9.1 says a CRA product with digital elements may also be a connected product or related service under the Data Act (Regulation (EU) 2023/2854) — for example a smart refrigerator that both sits in CRA scope and collects/communicates product data. The Data Act is not an Article 2 exclusion.

Does complying with Data Act data-access rules replace CRA Article 14?

No. FAQ 2.9.1 treats the two instruments as different in nature: the CRA regulates making products with digital elements available on the market; the Data Act regulates making product data and related-service data available to users and third parties. Sharing data under Data Act Articles 4 and 5, or refusing share under a trade-secret / safety-and-security handbrake, is not an ENISA Single Reporting Platform early warning.

How does the Data Act interact with CRA cybersecurity design?

FAQ 2.9.2: when a CRA product with digital elements is also subject to Data Act obligations to make data available (Articles 4 and 5 DA), the manufacturer must consider those DA requirements as part of the CRA cybersecurity risk assessment (Articles 6 and 13 CRA). The FAQ also points to Data Act measures that let data holders restrict or refuse sharing in defined cases — trade-secret and safety/security handbrakes (Articles 4(8), 5(11) and 4(2) DA). That is design and access governance, not an SRP substitute.

Must we redesign the product for both the Data Act and the CRA before Article 14 applies?

FAQ 2.9.3 says the Data Act imposes no strict redesign obligation — manufacturers remain free to design as they see fit if data-availability obligations are met. The same FAQ answer expressly states that CRA reporting obligations, for example for actively exploited vulnerabilities, apply for all products with digital elements (Article 14). Do not wait for a Data Act access architecture rewrite — or for 11 December 2027 Annex I conformity — before running the SRP chain on an in-scope product.

When do the calendars start — Data Act vs Article 14?

Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)). FAQ 2.9.3 itself contrasts full CRA cybersecurity application from 11 December 2027 (with Article 69(2) substantial-modification grandfathering) against Article 14 reporting that already covers all products with digital elements. The Data Act has its own application calendar for data-access duties. One regime’s timeline does not pause the other.

How is this different from GPSR or GDPR?

GPSR (FAQ 2.5 / Article 11) is consumer-product safety dual scope; GDPR (FAQ 2.8) is personal-data breach notification to a supervisory authority. The Data Act (FAQ 2.9) is product/related-service data availability to users and third parties. All three can attach beside Article 14; none is an MDR-style CRA product exclusion. See our GPSR and GDPR guides for those neighbouring traps.