Skip to content
CRA Reporting Desk

CRA Article 14 for medical devices: MDR/IVDR exclusion vs reporting

Connected health hardware looks like every other CRA product until you read Article 2. When the MDR or IVDR applies to the product, the CRA — and with it Article 14's 24-hour / 72-hour SRP chain — does not. When a wellness SKU or companion app sits outside that exclusion, the Article 14 clock can still start.

The short version

  • Article 2(2)(a)–(b): products to which the MDR (2017/745) or IVDR (2017/746) apply are outside the CRA.
  • FAQ 1.9: same exclusion list — no CRA means no mandatory Article 14 filing for that device.
  • Not every “health” product: non-MDR wellness wearables and software outside the device certificate can still be CRA products.
  • Different regime: MDR/IVDR vigilance stays; it does not run through ENISA's CRA Single Reporting Platform.
Track your Article 14 clockOpen the deadline calculator

What Article 2 actually excludes

Article 2(1) brings in products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Article 2(2) then switches the CRA off for products to which certain other Union acts apply — including, at (a) and (b), the MDR and the IVDR.

Commission FAQ 1.9 asks whether products covered by other Union legislation are exempted from the CRA and answers with that list: MDR, IVDR, Regulation (EU) 2019/2144 (motor vehicles), aviation products certified under Regulation (EU) 2018/1139, marine equipment under Directive 2014/90/EU, plus the Delegated Regulation (EU) 2025/1535 carve-out for most products under Regulation (EU) No 168/2013. For medical-device and IVD manufacturers, the operational consequence for reporting is simple: no CRA application → no Article 14 manufacturer duty for that product.

Article 14 only runs inside CRA scope

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks presuppose a product that is in CRA scope. An MDR-covered device is not that product for CRA purposes. Do not open an SRP case “just in case” for an excluded device and treat it as a substitute for MDR vigilance; the recipients and legal bases differ.

If you also place non-excluded products (or you are unsure which SKUs sit under MDR/IVDR), keep the Article 14 reporting deadlines and becoming-aware rules ready for the in-scope lines. Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

The companion-app and wellness traps

Teams often assume “we are a medical-device company, so CRA never applies.” Article 2(2) follows the Union act that applies to the product, not the company letterhead. A Class IIa device under the MDR is typically out of the CRA. A step-counter wearable that was never classified as a medical device is not out on that ground. A mobile companion app, clinician portal client or hospital integration component placed on the market as its own software product may be a CRA product with digital elements even when the certified device beside it is excluded — especially where a manufacturer-controlled backend is remote data processing under Article 3(2).

Inventory each marketed item: MDR/IVDR certificate scope, intended purpose, and whether the software is placed separately. White-label or OEM branding does not by itself create an MDR exclusion — see who is the manufacturer for brand-under-name lines that are still CRA products.

MDR/IVDR vigilance is not Article 14

Excluded medical devices and IVDs still sit under their sectoral reporting and vigilance frameworks. Those filings go to the medical-device / IVD authorities through the systems those regulations require — not through the CRA Single Reporting Platform to a coordinating CSIRT and ENISA under Article 14. Matching words like “incident” or “serious” across regimes does not merge the clocks. Keep CRA tooling for in-scope products; keep MDR/IVDR procedures for devices inside those regulations.

Personal data in a clinical or consumer health incident can still raise GDPR duties for whoever is the controller — CRA vs GDPR — and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Those regimes do not reopen CRA Article 14 for an Article 2(2)-excluded device. For the parallel motor-vehicle, aviation and marine exclusions, see Article 14 for motor vehicles, Article 14 for aviation and drones and Article 14 for marine equipment. Machinery is different: FAQ 2.4 / Recital 53 keep CRA and the Machinery Regulation in parallel for dual-scope products — see Article 14 for machinery.

Questions people ask

Do medical devices have a CRA Article 14 reporting duty?
Not when Regulation (EU) 2017/745 (MDR) or Regulation (EU) 2017/746 (IVDR) applies to that product with digital elements. Article 2(2)(a)–(b) excludes those products from the CRA entirely. Commission FAQ 1.9 repeats the same list. No CRA scope means no Article 14 early warning, 72-hour notification or final report through ENISA’s Single Reporting Platform for that device.
Is the exclusion “medical-looking” products, or only MDR/IVDR-covered ones?
Only products to which the MDR or IVDR apply. Article 2(2) is an exclusion by applicable Union act, not by marketing language. A general fitness tracker, wellness wearable or hospital integration tool that is not a medical device (or IVD) under those regulations is not carved out by Article 2(2)(a)–(b) and can still be a CRA product with digital elements — with Article 14 live from 11 September 2026 when the usual scope tests are met.
We ship an MDR-certified device plus a companion app. Is the app out too?
Not automatically. The CRA exclusion follows the product to which the MDR/IVDR applies. Software or accessories placed on the market that sit outside that MDR/IVDR coverage can still meet Article 2(1) / Article 3(1) as separate products with digital elements. Map each SKU (device certificate vs companion software vs cloud client) before you assume the whole stack is CRA-free. If the software is in CRA scope, Article 14 runs on that product — see also SaaS / remote data processing when a manufacturer backend is part of the product.
If we are outside CRA, what reporting do we still do?
MDR and IVDR keep their own vigilance and serious-incident reporting to the medical-device / IVD authorities through the channels those regulations require. That is a different regime, different recipients and different clocks from CRA Article 14. An ENISA SRP filing is not the MDR path, and an MDR vigilance submission is not an Article 14 filing. Confirm the live MDR/IVDR duties with counsel for your class and incident type.
Does GDPR or NIS2 change the MDR exclusion?
No for CRA scope. FAQ 1.9 / Article 2(2) decide whether the CRA (including Article 14) applies to the product. Personal-data breach duties under GDPR and entity-level incident duties under NIS2 are separate regimes — they can still apply to the organisation even when the medical device itself is outside the CRA. See our CRA vs GDPR and CRA vs NIS2 guides for the no-substitution framing on those filings.
What about motor vehicles, aviation or marine equipment?
FAQ 1.9 lists further CRA exclusions: Regulation (EU) 2019/2144 (motor vehicles / type-approval safety), products certified under Regulation (EU) 2018/1139 (civil aviation), equipment in Directive 2014/90/EU (marine), and Delegated Regulation (EU) 2025/1535 for most two-/three-wheel vehicles under Regulation (EU) No 168/2013 (with an L1e pedal-designed exception). Same logic as medical devices: if the CRA does not apply, Article 14 does not either. See our motor-vehicles, aviation-and-drones and marine-equipment guides for those stacks; this page focuses on the MDR/IVDR question manufacturers search for most often.

Track Article 14 only where CRA applies

Use the free desk or deadline calculator for 24-hour, 72-hour and final-report dates on in-scope products — including non-MDR wellness lines and companion software that still meet the CRA tests. No sign-up; data stays in your browser. Official CRA filing still goes through ENISA; MDR/IVDR vigilance stays on its own path.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether a given SKU is a product to which the MDR or IVDR applies, whether companion software is placed on the market as a separate product with digital elements, and which vigilance clock runs for a clinical incident are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Articles 2(1)–(2), 3(1)–(2), 14 and 71(2), and Commission CRA implementation FAQ entry 1.9 (exclusions for products covered by other Union legislation) as reproduced on the ORC WG mirror. Confirm against the Official Journal text (CRA on EUR-Lex), the MDR/IVDR texts, and current Commission guidance before relying on this for a live case.