CRA Article 14 for national security and defence: Article 2(7) exclusion vs reporting

What Article 2(7) actually excludes

Article 2(1) brings in products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Article 2(7) then carves out products with digital elements developed or modified exclusively for national security or defence purposes and products specifically designed to process classified information. Commission FAQ 1.8 quotes that limb and adds the dual-use rule: if the product is not specifically and exclusively developed or modified for those purposes, and not specifically designed to process classified information, it falls under the CRA.

FAQ 1.8 also notes Article 5(1): Member States may still impose additional cybersecurity requirements for procurement or use for specific purposes when necessary, proportionate and consistent with Union law. Those national add-ons sit beside CRA scope — they do not rewrite whether Article 14 exists for a dual-use market product.

When Article 14 does — and does not — attach

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks only exist for products inside CRA scope. A qualifying Article 2(7) product is outside scope, so that product itself has no SRP duty.

The common trap is treating any defence-adjacent sale as exclusive. FAQ 1.8 puts dual-use products back in when they are made available on the market without an exclusive national-security or defence modification. For those SKUs, Article 14 runs from 11 September 2026 (Article 71(2)), including where the same catalogue line also supplies government buyers. Keep the Article 14 reporting deadlines and becoming-aware rules ready for every build that fails the exclusive-purpose or classified-design test.

The trap: “government customer, so SRP can wait”

Sales and export-control teams often equate a defence end-user with a CRA exclusion. Article 2(7) asks how the product was developed or modified (or whether it was specifically designed for classified information), not whether the invoice names a ministry. An unmodified commercial firmware line sold into a secure facility is still a dual-use market product under FAQ 1.8 unless the exclusive-modification limb is actually met.

Inventory each SKU: exclusive defence/national-security build versus dual-use market product; whether a companion app or cloud backend meets remote data processing under Article 3(2); and who is the manufacturer under brand-under-name rules. White-label or integrator branding does not by itself create a national-security reporting holiday.

Article 2(8) and other regimes are not substitutes

Article 2(8) stops CRA duties from requiring disclosure contrary to essential Member State interests in national security, public security or defence. That can affect what you put in an SRP filing for an in-scope product; it does not move a dual-use SKU out of Article 2(1). Treat it as a counsel-led redaction question, not a reason to skip the 24- hour clock.

Personal data in a connected-product incident can still raise GDPR duties — CRA vs GDPR — and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Those regimes do not replace CRA Article 14 for an in-scope product. For other CRA product-class exclusions, see medical devices, motor vehicles, aviation and drones, marine equipment and identical spare parts.

Questions people ask

Do national-security or defence products have a CRA Article 14 reporting duty?

Not when they fall inside Article 2(7): products with digital elements developed or modified exclusively for national security or defence purposes, or products specifically designed to process classified information. Commission FAQ 1.8 repeats that exclusion. Outside the CRA, that product itself has no Article 14 early warning, 72-hour notification or final report through ENISA’s Single Reporting Platform.

Is selling to a ministry or defence customer enough to leave the CRA?

No. FAQ 1.8 turns on whether the product was specifically and exclusively developed or modified for national security or defence, or specifically designed to process classified information — not on who buys it. A commercial router, sensor or SaaS-backed device that a government also buys remains capable of CRA scope (and Article 14) when made available on the market.

What about dual-use products with both civilian and defence applications?

FAQ 1.8 is explicit: dual-use products are subject to the CRA when made available on the market, unless they are modified exclusively for national security or defence purposes. Catalogue dual-use SKUs that still ship as ordinary market products keep Article 14 from 11 September 2026 once awareness and the actively-exploited or severe-incident tests are met.

Does Article 2(8) cancel Article 14 for dual-use products?

No. Article 2(8) says CRA obligations must not entail supplying information whose disclosure would be contrary to essential Member State interests in national security, public security or defence. That is a disclosure limit for how you meet duties — it is not a product-scope exclusion like Article 2(7). Counsel decides what can be withheld; it does not turn a dual-use market product into an out-of-scope SKU.

If a defence-only SKU is out of CRA, can a civilian twin still need Article 14?

Yes. Article 2(7) is product-level. A specifically defence-modified build can be out while the parallel civilian or unmodified dual-use build stays in. Map each SKU to exclusive development/modification or classified-information design before you assume Article 14 is off.

How is this different from medical devices, vehicles, aviation, marine or spare parts?

Those are other Article 2 carve-outs (FAQ 1.9 sectoral lists, Article 2(6) identical spare parts). Article 2(7) / FAQ 1.8 is the national-security, defence and classified-information exclusion. Same result when it applies — no CRA means no Article 14 SRP for that product — but the test is exclusive purpose or classified design, not MDR, type-approval, EASA, Directive 2014/90 or identical repair stock.