Skip to content
CRA Reporting Desk

CRA Article 14 for important and critical products: Annex III/IV vs reporting

Teams often treat "important" or "critical" under Annex III/IV as if it rewrote the reporting calendar — either "we're default, so SRP waits until 2027" or "we're Class II, so the clocks are different." Neither is true. Classification changes conformity assessment. Article 14's 24-hour / 72-hour chain is the same for every in-scope manufacturer product.

The short version

  • Same Art 14 clocks: default, Annex III important (Class I/II) and Annex IV critical products share 24h / 72h / final-report rules.
  • Class ≠ reporting holiday: Articles 7–8 / FAQ 3.1 tie important and critical status to Article 32 assessment routes, not to Article 14.
  • Live now vs CE later: Article 14 from 11 September 2026; Annex I / Article 32 package generally from 11 December 2027 (Article 71(2)).
  • No automatic inheritance: FAQ 3.2 / Article 7(1) — integrating an important component does not by itself make the host important for assessment.
Track your Article 14 clockOpen the deadline calculator

What Articles 7–8 and FAQ 3.1 actually say

Article 7(1): products with digital elements that have the core functionality of a category in Annex III are important products and are subject to the conformity assessment procedures in Article 32(2) and (3). Integrating such a product into another does not in itself push the host onto those procedures. Article 8 does the parallel job for Annex IV critical products — Commission delegated acts may require European cybersecurity certification at least at assurance level "substantial"; otherwise those products follow Article 32(3).

Commission FAQ 3.1 repeats the core-functionality test and points to Commission Implementing Regulation (EU) 2025/2392 for technical descriptions of the Annex III/IV categories. FAQ 3.2 walks the integration examples (embedded browser in a news app; secure element in a laptop). FAQ 3.3 adds that important/critical status does not replace the Article 13 risk-assessment duty — every manufacturer still assesses risks proportionate to intended and reasonably foreseeable use. None of those FAQ entries rewrite Article 14.

Article 14 has no important/critical limb

Article 14 obliges a manufacturer to notify actively exploited vulnerabilities contained in the product with digital elements, and severe incidents having an impact on that product's security, simultaneously to the coordinating CSIRT and ENISA via the Single Reporting Platform. The duty turns on manufacturer status, CRA product scope, and awareness — not on whether Annex III or IV lists the SKU's core functionality. Keep the reporting-deadlines and becoming-aware guides for the clock math; use this page only to stop class-based excuses.

Article 71(2) applies Article 14 from 11 September 2026. Article 69(3) keeps reporting on in-scope products placed before 11 December 2027. The later December 2027 date is when the essential-requirements and conformity-assessment stack — including stricter routes for important and critical products — generally applies. Do not wait for a notified-body slot or EUCC certificate before filing an early warning.

The trap: “default products don’t report” / “Class II has a different SRP”

Compliance roadmaps often put Annex III/IV work on the 2027 CE critical path and leave Article 14 as a footnote for "high-risk SKUs." That inverts the calendar. Routers, modems and switches, operating systems, browsers, password managers, VPNs, smart home security products, connected toys with social or location features, wearables outside MDR/IVDR, hypervisors, firewalls and the other Annex III/IV categories still face the same SRP clocks as a simple connected sensor that stays in the default class.

Conversely, a default-class manufacturer who assumes "we're not important, so ENISA can wait" is wrong the moment the product is in Article 2(1) / 3(1) scope and awareness hits. Map core functionality for assessment planning; map CRA scope and manufacturer identity for reporting. Brand-under-name and OEM/ODM rules still decide who is the manufacturer — see white-label / OEM-ODM.

Related pages, not substitutes

When the exploit sits in a third-party component, both the finished-product manufacturer and (if placed separately) the component manufacturer can have Article 14 duties — third-party components. Radio equipment in Delegated Regulation (EU) 2022/30 categories stays in CRA during the RED bridge (RED / radio equipment); many of those SKUs are also Annex III routers/modems. Connected machinery can be dual-scope with the Machinery Regulation (machinery) without becoming an Article 2 exclusion. Connected consumer products under GPSR (EU) 2023/988 are also dual-scope (FAQ 2.5 / Article 11) — see GPSR / consumer products. EHR systems under EHDS (EU) 2025/327 are dual-scope too, with Article 32(5a) swapping the CRA assessment procedure for EHDS Chapter III — still the same Article 14 clocks; see EHDS / EHR systems. True CRA carve-outs remain medical devices, motor vehicles, aviation and drones, marine equipment, identical spare parts and national security and defence. Parallel GDPR, NIS2 or AI Act filings never close an SRP duty (vs GDPR, vs NIS2, vs AI Act).

Questions people ask

Do important or critical products have different Article 14 deadlines?
No. Article 14 binds manufacturers of products with digital elements that fall in CRA scope. It does not create a separate clock for Annex III important Class I/II or Annex IV critical products. Early warning within 24 hours of becoming aware, fuller notification within 72 hours, and the final-report triggers are the same whether your SKU is default, important or critical. Articles 7 and 8 point those classes at Article 32 conformity assessment procedures — not at a different SRP calendar.
We’re a ‘default’ product — does Article 14 wait until December 2027?
No. Article 71(2) applies Article 14 from 11 September 2026 for in-scope products, including products already on the market (Article 69(3)). The 11 December 2027 date is when the Annex I essential-requirements package, market surveillance and the rest of the CRA generally apply — including the stricter Article 32 routes for important and critical products. Being outside Annex III/IV does not postpone SRP filing.
We’re Annex III (router, OS, smart lock, connected toy…) — does that mean we report earlier or harder?
You report on the same Article 14 clocks as everyone else in CRA scope. Annex III / FAQ 3.1 classification is about core functionality and the conformity assessment procedures in Article 32(2)/(3). Recital 10 and Articles 7–8 frame important/critical status as a stricter CE / assessment path, not as a heavier or earlier Single Reporting Platform duty. Book notified-body capacity for 2027 conformity; run the 24-hour / 72-hour chain now when awareness hits.
We integrate an important component (browser, OS, secure element). Does our host product inherit Annex III reporting?
Integration does not automatically inherit the component’s important/critical class for conformity assessment — Article 7(1) and FAQ 3.2 say so expressly (embedded browser in a news app; secure element in a laptop). Article 14 still attaches to each manufacturer of an in-scope product with digital elements that becomes aware of an actively exploited vulnerability contained in that product (or of a severe incident impacting its security). Map the host’s own core functionality for Annex III/IV, and see our third-party-components guide for who notifies when the exploit is in an integrated part.
Does a European cybersecurity certificate or notified-body opinion replace an SRP filing?
No. Article 8 may require European cybersecurity certification for some Annex IV critical products (or fall back to Article 32(3) third-party assessment where no delegated act applies). That is market-access evidence for essential cybersecurity requirements. Article 14 notifications go through ENISA’s Single Reporting Platform to a coordinating CSIRT. A certificate, EU declaration of conformity or technical file is not an early warning.
How is this different from medical devices or machinery?
MDR/IVDR devices can leave the CRA under Article 2(2) — so Article 14 does not attach to that excluded product. Machinery is dual-scope interplay (FAQ 2.4): still in CRA when connected. Important/critical classification is neither exclusion nor dual-regime holiday — every in-scope PDE manufacturer faces Article 14; only the Article 32 assessment route changes by class. See our medical-devices and machinery guides for those traps.

Track Article 14 whatever your Annex class

Use the free desk or deadline calculator for 24-hour, 72-hour and final-report dates on default, important and critical products alike — including stock already at customer sites. No sign-up; data stays in your browser. Official CRA filing still goes through ENISA; Annex III/IV conformity assessment stays on its own 2027 path.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether a given SKU has the core functionality of an Annex III or IV category, which Article 32 route applies, who is the manufacturer, and which clocks run for a security event are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Articles 7, 8, 14, 32, 69(3) and 71(2), Recital 10, and Commission FAQ 3.1–3.3 as reproduced on the ORC WG mirror (including Implementing Regulation (EU) 2025/2392 for technical descriptions). Confirm against the Official Journal text (CRA on EUR-Lex) and the Commission FAQ before relying on this for a live case.