Skip to content
CRA Reporting Desk

CRA Article 14 for IoT and connected products: Art 3(1) PDE ≠ GPSR or Dec 2027 holiday

Connected-device teams often invent two escapes that the Cyber Resilience Act does not grant: “we’re under GPSR / product safety, so cybersecurity reporting can wait,” or “nothing bites until 11 December 2027.” For in-scope IoT and connected hardware/software, Article 2(1) and Article 3(1) already define a product with digital elements — and Article 14's 24-hour / 72-hour SRP chain has applied from 11 September 2026.

The short version

  • Art 3(1) PDE: software or hardware product + its remote data processing solutions (including separately placed components).
  • Art 2(1) connection: intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.
  • Indirect still counts: Article 3(10) — hub-only / gateway sensors are not an automatic carve-out.
  • GPSR ≠ exclusion: FAQ 2.5 / Article 11 dual scope for consumer safety — not an MDR-style Article 2 exit.
  • Dec 2027 ≠ Art 14 holiday: reporting from 11 Sep 2026 (Art 71(2)); legacy catalogue still in (Art 69(3)).
Track your Article 14 clockOpen the deadline calculator

What Article 2(1) and Article 3(1) actually say

Article 2(1): this Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network. That is the scope gate for almost every IoT and connected-product SKU that is sold or otherwise made available in the course of a commercial activity on the Union market.

Article 3(1) defines a product with digital elements as a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately. Article 3(2) defines remote data processing as processing at a distance for which the software is designed and developed by the manufacturer, or under the manufacturer's responsibility, and the absence of which would prevent the product from performing one of its functions. Article 3(8)–(10) spell out logical, physical and indirect connections — so “we only talk to our own hub” is usually still a connection for scope purposes.

“IoT” is not a separate legal class in the CRA. The question is always: PDE under Article 3(1), connection under Article 2(1), manufacturer under the economic-operator rules, and then awareness of an actively exploited vulnerability or severe incident under Article 14.

Article 14 clocks still attach inside CRA scope

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks attach when you are the manufacturer of an in-scope CRA product and awareness moves. They do not wait for a completed GPSR file, a Data Act access redesign, or for 11 December 2027 Annex I conformity.

Keep the Article 14 reporting deadlines, becoming-aware, legacy-products and SaaS / remote data processing guides ready for devices already at retail or in the field. Article 69(3) keeps reporting on in-scope products placed before 11 December 2027.

The trap: “GPSR / Dec 2027 means SRP can wait”

Two failure modes dominate IoT triage. First: product-safety or retail teams treat GPSR (or a Safety Gate / Safety Business Gateway accident path) as if it were an MDR-style CRA exclusion. For medical devices, vehicles, aviation and marine, Article 2 can truly remove the product. For GPSR it cannot — FAQ 2.5 / Article 11 is interplay. Full detail: CRA Article 14 for consumer products / GPSR.

Second: engineering and programme plans treat 11 December 2027 as a universal CRA start date. Article 71(2) and Recital 126 are explicit: reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026; the rest of the package (including Annex I essential requirements for most products) applies from 11 December 2027. Article 13 / Annex I Part II vulnerability handling is that later process track — not a substitute for live SRP filing (Article 14 vs Article 13 vulnerability handling).

Inventory each SKU for the connection and PDE tests first (firmware, companion app, manufacturer cloud). Then map who is the manufacturer under brand-under-name / OEM-ODM rules — common for white-label smart-home and industrial IoT. Separately marketed modules and SoCs can be their own PDEs when placed on the market (third-party components).

Neighbouring regimes are not substitutes

Smart appliances that collect and share product data can also sit under the Data Act (CRA vs Data Act). Personal data on a compromised device can still raise GDPR duties (CRA vs GDPR). Some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Radio equipment under Delegated Regulation (EU) 2022/30 stays in CRA (RED / radio equipment). Connected machinery is the industrial dual-scope twin (machinery). None of those replace an SRP filing for an in-scope manufacturer product. For true CRA product-class exclusions, see medical devices, motor vehicles, aviation and drones, marine equipment, identical spare parts and national security and defence.

Questions people ask

Do IoT and connected products have a CRA Article 14 reporting duty?
Yes when the SKU is a product with digital elements under Article 3(1) inside Article 2(1) scope — a software or hardware product (and its remote data processing solutions) made available on the Union market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Consumer and industrial IoT are not on the Article 2(2)–(4) exclusion list just because they are “IoT.”
Our sensor only talks to a hub — are we out of scope?
Usually not. Article 3(10) defines an indirect connection as a connection to a device or network that does not take place directly but as part of a larger system that is directly connectable. A sensor that only speaks to a gateway, hub or companion app still meets the Article 2(1) connection test when that larger system reaches a device or network. Map the intended and reasonably foreseeable use, not only the first hop.
Does GPSR compliance or a Safety Gate file replace Article 14 for smart consumer devices?
No. GPSR (Regulation (EU) 2023/988) is consumer-product safety dual scope with the CRA (FAQ 2.5 / Article 11) — not an Article 2 exclusion. A Safety Business Gateway / Safety Gate accident file is not an ENISA Single Reporting Platform early warning. Full walkthrough: our GPSR consumer-products guide.
Can we wait until 11 December 2027 before reporting on connected devices already shipping?
No for Article 14. Article 71(2) applies reporting from 11 September 2026; the wider Regulation (including Annex I essential requirements for most products) applies from 11 December 2027. Article 69(3) keeps Article 14 on in-scope products placed before that later date. Waiting for CE / Annex I conformity is the classic Dec 2027 holiday trap — see also our Article 13 vulnerability-handling and legacy-products guides.
Does the manufacturer cloud / companion app count?
Often yes as remote data processing. Article 3(1) includes the product’s remote data processing solutions; Article 3(2) covers data processing at a distance designed and developed by or under the responsibility of the manufacturer, without which the product could not perform one of its functions. Recital 12’s smart-home control example sits in that pattern. Standalone third-party cloud that is outside the manufacturer’s responsibility is a different analysis — see our SaaS / remote data processing guide.
How is this different from Data Act “connected products”?
Data Act (EU) 2023/2854 “connected product” is about product data availability to users and third parties (FAQ 2.9). CRA Article 2(1) / 3(1) is about cybersecurity scope for products with digital elements. The same smart appliance can be both; neither label pauses the other’s clocks. See our Data Act guide for that dual-scope trap.

Track Article 14 on IoT and connected products now

Use the free desk or deadline calculator for 24-hour, 72-hour and final-report dates on in-scope connected PDEs — including hub-attached sensors, companion-app devices and units already with end users. No sign-up; data stays in your browser. Official CRA filing still goes through ENISA; GPSR / Data Act duties stay on their own paths.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether a given SKU is a product with digital elements under the CRA, whether its intended or reasonably foreseeable use includes a qualifying connection, who is the manufacturer, and which clocks run for a security or safety event are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Articles 2(1), 3(1)–(2)/(8)–(10), 14, 69(3) and 71(2), Recital 126 on the early reporting application date, and Commission FAQ 2.5 / 2.9 interplay for neighbouring GPSR and Data Act traps. Confirm against the Official Journal text (CRA on EUR-Lex) and current Commission / ENISA guidance before relying on this for a live case.