CRA Article 14 for EHDS EHR systems: dual scope vs reporting

What FAQ 2.7 and Article 32(5a) actually say

Commission FAQ 2.7.1: the CRA and the European Health Data Space Regulation both regulate making products available on the market — CRA for essential cybersecurity requirements on products with digital elements; EHDS for essential requirements (including interoperability and logging) and further obligations for Electronic Health Record systems. A product may be both at once. The FAQ's hospital example is deliberate: software marketed and procured for storing and viewing patient summaries while delivering healthcare can be a CRA product with digital elements that is also an EHDS EHR system.

FAQ 2.7.2 / Recital 112 EHDS add the dual-compliance rule teams miss: comply with both; meeting either instrument's cybersecurity requirements alone will not fully satisfy the other. Article 13(4) only allows the CRA cybersecurity risk assessment to sit inside the EHDS risk assessment for those dual products — documentation synergy, not a reporting waiver.

FAQ 2.7.3 / Article 32(5a) (inserted by EHDS Article 104) is the line misread as “EHR = out of CRA.” Manufacturers of products with digital elements classified as EHR systems under Regulation (EU) 2025/327 shall demonstrate conformity with CRA Annex I using the relevant EHDS Chapter III conformity assessment procedure — instead of the CRA's own Article 32 procedures. That changes how you prove essential cybersecurity requirements for market access. It does not rewrite Article 14, the Single Reporting Platform, or the 24-hour / 72-hour clocks.

Article 14 still runs on dual-scope EHR products

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. That duty has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

Nothing in FAQ 2.7, Article 13(4), Article 32(5a) or EHDS Chapter III scales, delays or replaces those clocks. An EHDS conformity decision, harmonised-component assessment or single EU declaration of conformity (FAQ 2.7.4 / EHDS Article 39(2) / CRA Article 28(3)) is not an early warning. Clock detail lives in the reporting deadlines and becoming-aware guides. Legacy EHR already placed before 11 December 2027 still faces Article 14 under Article 69(3) when in scope — see legacy products.

The trap: “EHDS assessment replaced CRA, so SRP can wait”

Two failure modes show up in triage. First: treating Article 32(5a) as an Article 2-style exclusion (like MDR/IVDR medical devices) and skipping ENISA when an actively exploited vulnerability or severe incident hits an in-scope EHR product. Second: waiting for a finished EHDS Chapter III file, a shared risk assessment under Article 13(4), or 11 December 2027 Annex I application before filing. Assessment paperwork and SRP are different jobs on different calendars.

Neighbouring traps: true MDR/IVDR medical-device exclusion (no CRA → no Art 14 for that product); Annex III/IV class (also Art 32-only — same reporting clocks); standalone SaaS (usually outside CRA) versus a shipped EHR product with remote data processing inside the product; and parallel GDPR / NIS2 / AI Act filings that never close an SRP duty.

Related dual-scope pages, not substitutes

Connected machinery (FAQ 2.4) and consumer products / GPSR (FAQ 2.5) are the same dual-compliance pattern without an Article 32 swap. Radio equipment under the RED bridge (RED) stays in CRA for reporting while conformity transitions. Who places the EHR under their name still decides manufacturer identity — see white-label / OEM-ODM.

Questions people ask

Do EHR / hospital health-record systems have a CRA Article 14 reporting duty?

Yes when the product is a product with digital elements inside CRA Article 2(1) / Article 3(1) and you are its manufacturer. Commission FAQ 2.7.1 says a product can be both a CRA product with digital elements and an EHR system under the European Health Data Space Regulation (EU) 2025/327 at the same time — for example hospital software marketed for storing and viewing patient summaries. EHDS is not an Article 2 exclusion.

Does EHDS conformity assessment replace CRA Article 14?

No. FAQ 2.7.3 / Article 32(5a) say that for CRA products classified as EHR systems, manufacturers demonstrate conformity with CRA Annex I essential cybersecurity requirements using the EHDS Chapter III conformity assessment procedure instead of the CRA’s own Article 32 procedures. That is a market-access assessment shortcut. Article 14 notifications still go through ENISA’s Single Reporting Platform to a coordinating CSIRT on the 24-hour / 72-hour / final-report chain.

If we already meet EHDS requirements, are we done for CRA cybersecurity?

Not fully. FAQ 2.7.2 / Recital 112 EHDS say dual-scope products must comply with both instruments, and that compliance with either regulation’s cybersecurity requirements alone will not fully satisfy the other. Article 13(4) only lets the CRA cybersecurity risk assessment be part of the EHDS risk assessment — it does not cancel Annex I duties or Article 14.

Is this the same as the medical-devices exclusion?

No. MDR/IVDR devices can leave the CRA under Article 2(2), so Article 14 does not attach to that excluded product. EHR systems under EHDS are the opposite pattern: FAQ 2.7 keeps CRA and EHDS in parallel for dual-scope products. Map MDR/IVDR exclusion first if the SKU is a medical device or IVD; otherwise treat connected EHR software as potential CRA + EHDS dual scope.

When do the clocks start — EHDS vs Article 14?

Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)). EHDS (Regulation (EU) 2025/327) has its own application calendar for EHR obligations and Chapter III assessment. Do not wait for a completed EHDS file — or for 11 December 2027 Annex I / Article 32 application — before running the SRP chain on an in-scope EHR product.

Can one EU declaration of conformity cover both CRA and EHDS?

FAQ 2.7.4 points to EHDS Article 39(2) and CRA Article 28(3): a single EU declaration of conformity can cover all applicable Union legal acts, identifying each act. That paperwork convenience still is not an ENISA early warning.