CRA Article 14 for consumer products: GPSR dual scope vs reporting

What FAQ 2.5 and Article 11 actually say

Commission FAQ 2.5.1: the CRA and the General Product Safety Regulation both regulate making products available on the market, but they differ in product coverage and in the requirements they set. The CRA applies to products with digital elements and sets cybersecurity requirements. The GPSR applies to consumer products to the extent that no specific Union provisions with the same objective already regulate the safety of the products concerned, and it sets safety requirements.

FAQ 2.5.2 answers the dual-compliance question manufacturers miss: a product with digital elements may need to comply with both. When a PDE also poses risks beyond the cybersecurity risks covered by the CRA, those other risks may be regulated by other EU legislation such as the GPSR. As long as there is no product-specific regulation covering those other risks, the GPSR applies to the safety aspects — and the FAQ points expressly to Article 11 of the CRA.

Article 11 (General product safety) brings specified GPSR chapters to products with digital elements for aspects and risks or categories of risks that are not covered by the CRA, where those products are not subject to specific safety requirements in other Union harmonisation legislation. That is interplay language — the opposite of an Article 2 carve-out.

Article 14 clocks still attach inside CRA scope

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks attach when you are the manufacturer of an in-scope CRA product and awareness hits. They do not wait for a completed GPSR risk assessment, a Safety Business Gateway submission, or for 11 December 2027 Annex I application.

Keep the Article 14 reporting deadlines, becoming-aware and legacy-products guides ready for connected consumer products already at retail or in users' homes. Article 69(3) keeps reporting on in-scope products placed before 11 December 2027.

The trap: “we’re under GPSR, so SRP can wait”

Retail and product-safety teams often copy the medical-device mental model: another Union act applies, therefore CRA (and Article 14) does not. For MDR/IVDR, vehicles, aviation and marine that can be true under Article 2. For GPSR it is false. FAQ 2.5 is titled interplay, not exclusion. A CE / GPSR conformity story, consumer-facing recall notice or Safety Gate notification is not an ENISA SRP early warning.

Inventory each SKU for CRA connection and product definition first (firmware, companion app, cloud backend — see remote data processing). Then map who is the manufacturer under brand-under-name / OEM-ODM rules. Connected toys with social or location features, smart-home products and many wearables outside MDR/IVDR can also be Annex III important for conformity assessment — that still does not rewrite Article 14; see important and critical products.

Other regimes are not substitutes

Personal data in a consumer-device incident can still raise GDPR duties (CRA vs GDPR), and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Neither replaces an SRP filing for an in-scope manufacturer product. Connected machinery under the Machinery Regulation is the industrial dual-scope twin of this GPSR pattern (machinery). For true CRA product-class exclusions, see medical devices, motor vehicles, aviation and drones, marine equipment, identical spare parts and national security and defence. Radio equipment under Delegated Regulation (EU) 2022/30 stays in CRA (RED / radio equipment) — another dual-calendar pattern, not an exclusion.

Questions people ask

Do consumer IoT and connected products have a CRA Article 14 reporting duty?

Yes when the SKU is a product with digital elements inside CRA Article 2(1) / Article 3(1) — typically because its intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Consumer products are not on the Article 2(2)–(4) exclusion list. Commission FAQ 2.5.1–2.5.2 treat CRA cybersecurity and GPSR safety as different regimes that can both apply; they do not turn GPSR into a reporting holiday.

Does GPSR compliance replace CRA Article 14?

No. FAQ 2.5.1 says the CRA sets cybersecurity requirements for products with digital elements, while the GPSR sets safety requirements for consumer products (where no product-specific Union law covers the same safety objective). FAQ 2.5.2 / Article 11 add that non-cyber risks on a PDE can still pull in GPSR. A Safety Business Gateway filing, recall file or GPSR technical documentation is not an ENISA Single Reporting Platform early warning.

We’re already reporting accidents through the Safety Business Gateway — are we done?

Not for CRA cybersecurity events. GPSR economic-operator notifications (including accident-related duties via the Safety Business Gateway on Safety Gate) address product safety risks. Article 14 addresses actively exploited vulnerabilities and severe incidents impacting the security of the product with digital elements, through ENISA’s SRP, with the 24-hour / 72-hour / final-report chain. One channel does not close the other when both tests are met.

Our product is only B2B — does GPSR decide whether Article 14 applies?

No. Article 14 turns on CRA manufacturer status, product scope and awareness — not on whether the GPSR also applies as a consumer-product safety law. FAQ 2.5 is about interplay when both regimes can attach; it is not a B2B carve-out from the CRA. Map CRA Article 2(1) / 3(1) first; then ask separately whether residual non-cyber safety risks still engage GPSR under Article 11.

When do the calendars start — GPSR vs Article 14?

Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)). GPSR (Regulation (EU) 2023/988) has its own application calendar for general product safety. Do not wait for a completed GPSR file — or for 11 December 2027 Annex I conformity — before running the SRP chain on an in-scope connected consumer product.

How is this different from medical devices or machinery?

MDR/IVDR devices can leave the CRA under Article 2(2) — so Article 14 does not attach to that excluded product. Machinery is dual-scope with the Machinery Regulation (FAQ 2.4). GPSR is the consumer-safety dual-scope pattern (FAQ 2.5 / Article 11): still in CRA when the PDE tests are met, with GPSR able to cover residual non-cyber safety risks. See our medical-devices and machinery guides for those neighbouring traps.