Skip to content
CRA Reporting Desk

CRA Article 14 for marine equipment: Directive 2014/90 exclusion vs reporting

Connected bridge gear looks like every other CRA product until you read Article 2(4). When the equipment falls within Directive 2014/90/EU, the CRA — and with it Article 14's 24-hour / 72-hour SRP chain — does not apply. When a component sits outside that Directive but is still placed on the market as a product with digital elements, the Article 14 clock can still start.

The short version

  • Article 2(4): equipment within Directive 2014/90/EU (marine equipment) is outside the CRA.
  • FAQ 1.9 / 2.2.1: same exclusion — no CRA means no mandatory Article 14 filing for that marine equipment item.
  • Listed scope: FAQ 2.2.1 points to Implementing Regulation (EU) 2025/1533 for what counts as Directive 2014/90 equipment.
  • Unlisted components: intended for marine equipment but not themselves in that Directive can still trigger Article 14 when placed on the market.
Track your Article 14 clockOpen the deadline calculator

What Article 2(4) actually excludes

Article 2(1) brings in products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Article 2(4) then switches the CRA off for equipment that falls within the scope of Directive 2014/90/EU of the European Parliament and of the Council on marine equipment.

FAQ 2.2.1 explains the overlap: both regimes set rules for making products available on the market — the CRA for products with digital elements, Directive 2014/90 for marine equipment. On that basis, Article 2(4) exempts equipment within that Directive from CRA applicability. Commission FAQ 1.9 lists the same marine limb alongside MDR/IVDR, motor vehicles and aviation certification. For maritime product teams, the operational consequence for reporting is simple: no CRA application → no Article 14 manufacturer duty for that Directive 2014/90 equipment.

Article 14 only runs inside CRA scope

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks presuppose a product that is in CRA scope. Equipment within Directive 2014/90/EU is not that product for CRA purposes. Do not open an SRP case “just in case” for an excluded marine item and treat it as a substitute for wheel-mark / flag-State processes; the recipients and legal bases differ.

If you also place non-excluded products (or you are unsure which SKUs sit in the 2014/90 list), keep the Article 14 reporting deadlines and becoming-aware rules ready for the in-scope lines. Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

The component trap: intended for ships ≠ automatically out

Teams often assume “we sell to shipyards, so CRA never applies.” Article 2(4) follows equipment within Directive 2014/90/EU, not the maritime customer. FAQ 2.2.1 is explicit that components intended for integration into Directive 2014/90 equipment but not themselves within that Directive may be covered by the CRA if they are products with digital elements made available on the market. FAQ 2.2.1 also points to Commission Implementing Regulation (EU) 2025/1533 for the annex that lists equipment in Directive 2014/90 scope — use that list, not a sales-channel guess.

Inventory each marketed item: whether it is wheel-marked marine equipment under 2014/90, a separately placed sensor/module/app, and whether a companion fleet or bridge backend meets remote data processing under Article 3(2). White-label or dealer branding does not by itself create an Article 2(4) exclusion — see who is the manufacturer for brand-under-name lines that are still CRA products.

Marine equipment conformity is not Article 14

Excluded Directive 2014/90 equipment still sits under that Directive's conformity assessment, wheel mark and flag-State approval frameworks. Those filings and duties go through the marine-equipment authorities and processes that act requires — not through the CRA Single Reporting Platform to a coordinating CSIRT and ENISA under Article 14. Keep CRA tooling for in-scope components and accessory lines; keep Directive 2014/90 procedures for listed marine equipment.

Personal data in a connected-bridge or vessel-ops incident can still raise GDPR duties for whoever is the controller — CRA vs GDPR — and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Those regimes do not reopen CRA Article 14 for an Article 2(4)-excluded marine item. For the parallel MDR/IVDR, motor-vehicle and aviation exclusion patterns, see Article 14 for medical devices, Article 14 for motor vehicles and Article 14 for aviation and drones. Radio equipment under Delegated Regulation (EU) 2022/30 is not an exclusion — Article 14 already applies; see Article 14 for radio equipment (RED).

Questions people ask

Does marine equipment have a CRA Article 14 reporting duty?
Not when the equipment falls within the scope of Directive 2014/90/EU on marine equipment. Article 2(4) of the CRA excludes that equipment from the CRA entirely. Commission FAQ 1.9 and FAQ 2.2.1 repeat the same point. No CRA scope means no Article 14 early warning, 72-hour notification or final report through ENISA’s Single Reporting Platform for that Directive 2014/90 equipment item.
How do I know if my product is “marine equipment” for this exclusion?
FAQ 2.2.1 points to the annex of Commission Implementing Regulation (EU) 2025/1533 for the design, construction and performance requirements and testing standards that list equipment within Directive 2014/90/EU. The Directive itself covers equipment placed or to be placed on board an EU ship for which flag-State approval is required by the relevant international instruments. Map the SKU to that list — not to a “we sell to shipping” company label — before you assume Article 14 is off.
What about components meant for marine equipment?
FAQ 2.2.1 draws an explicit line: where components are intended for integration into equipment within Directive 2014/90/EU but those components do not themselves fall within that Directive, they may still be CRA products with digital elements when made available on the market. Article 14 can apply to that separately placed component even when the wheel-marked marine equipment beside it is out.
If the equipment is out of CRA, what cybersecurity reporting still applies?
Marine equipment under Directive 2014/90/EU still sits under that Directive’s conformity, wheel-mark and flag-State approval stack (and any cybersecurity or safety duties that regime requires). Those channels are not ENISA CRA Single Reporting Platform filings under Article 14. Matching words like “incident” or “vulnerability” across regimes does not merge the clocks. Confirm live marine-equipment duties with counsel for your item and flag State.
Does GDPR or NIS2 reopen Article 14 for excluded marine equipment?
No for CRA scope. FAQ 1.9 / Article 2(4) decide whether the CRA (including Article 14) applies to the equipment. Personal-data breach duties under GDPR and entity-level incident duties under NIS2 are separate regimes — they can still apply to the organisation even when the Directive 2014/90 equipment itself is outside the CRA. See our CRA vs GDPR and CRA vs NIS2 guides for the no-substitution framing.
What about medical devices, motor vehicles or aviation products?
FAQ 1.9 lists further CRA exclusions: MDR/IVDR (Article 2(2)(a)–(b)), products to which Regulation (EU) 2019/2144 applies (motor vehicles), and products certified under Regulation (EU) 2018/1139 (civil aviation). Same logic: if the CRA does not apply, Article 14 does not either. See our medical-devices, motor-vehicles and aviation-and-drones guides for those stacks; this page focuses on the marine-equipment / Directive 2014/90 question manufacturers search for most often in the maritime stack.
Is radio / Wi-Fi equipment excluded the same way?
No. FAQ 2.6.1 confirms the CRA applies to categories of radio equipment under Delegated Regulation (EU) 2022/30 — unlike Article 2(4) marine equipment. Article 14 already runs from 11 September 2026 for those in-scope radio products even while RED cybersecurity still covers many placements until 10 December 2027. See our radio-equipment (RED) guide.

Track Article 14 only where CRA applies

Use the free desk or deadline calculator for 24-hour, 72-hour and final-report dates on in-scope products — including components and companion software that still meet the CRA tests even when neighbouring marine equipment is out under Directive 2014/90/EU. No sign-up; data stays in your browser. Official CRA filing still goes through ENISA; marine equipment conformity stays on its own path.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether a given SKU falls within Directive 2014/90/EU (and Implementing Regulation (EU) 2025/1533), and which marine conformity or flag-State clock runs for a security event, are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Articles 2(1), 2(4), 3(1)–(2), 14, 69(3) and 71(2), and Commission CRA implementation FAQ entries 1.9 and 2.2.1 (marine exclusion and component caveat) as reproduced on the ORC WG / Commission FAQ mirrors. Confirm against the Official Journal text (CRA on EUR-Lex), Directive 2014/90/EU, and current Commission guidance before relying on this for a live case.