CRA Article 14 for radio equipment: RED Delegated Regulation vs reporting

What FAQ 2.6.1 actually says

Article 2(1) brings in products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Radio equipment with a network interface routinely meets that test. Commission FAQ 2.6.1 then states that the CRA applies to the categories of radio equipment in scope of Delegated Regulation (EU) 2022/30 adopted under Directive 2014/53/EU (the Radio Equipment Directive) — the instrument that activated RED Articles 3(3)(d), (e) and (f) cybersecurity requirements for those categories from 1 August 2025.

That is the opposite of FAQ 1.9's exclusion list (MDR/IVDR, type-approved motor vehicles, EASA-certified aviation products, marine equipment under Directive 2014/90/EU). For radio teams, the operational consequence for reporting is: CRA applies → Article 14 manufacturer duty runs for in-scope radio products, subject to the usual awareness and actively-exploited / severe-incident tests.

Article 14 runs before the December 2027 conformity switch

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. FAQ 7.1 and Article 71(2) put those reporting obligations live from 11 September 2026. The wider manufacturer duty to ensure conformity with Annex I essential cybersecurity requirements (and most other CRA provisions) applies from 11 December 2027.

FAQ 2.6.1’s placement calendar sits on that conformity track: radio equipment in the Delegated Regulation categories placed between 1 August 2025 and 10 December 2027 remains subject to the RED Delegated Regulation’s cybersecurity essential requirements; placements from 11 December 2027 follow the CRA once it fully applies (the Commission aims to repeal the RED Delegated Regulation as of that date — Delegated Regulation (EU) 2026/339). Do not read that bridge as a delay of Article 14. Keep the Article 14 reporting deadlines and becoming-aware rules ready now for in-scope radio lines, including products already on the market (Article 69(3)).

The trap: “we’re on RED until 2027, so SRP can wait”

Teams often assume that because RED cybersecurity (and EN 18031 series standards supporting it) still governs placement until December 2027, CRA reporting is optional until then. FAQ 2.6.1 and FAQ 7.1 separate those questions. RED answers whether the product met the radio-cyber essential requirements when it was placed on the market. Article 14 answers whether, after awareness of active exploitation or a severe incident, you must notify via the SRP. Certificate continuity under FAQ 7.1 (EU-type examination certificates and approval decisions under legislation such as Delegated Regulation (EU) 2022/30 remain valid until 11 June 2028 unless they expire earlier) likewise protects conformity evidence — it does not pause reporting.

Inventory each marketed radio SKU: whether it falls in a 2022/30 category, whether a companion app or cloud backend meets remote data processing under Article 3(2), and who is the manufacturer under brand-under-name rules. White-label or retailer branding does not by itself create a RED-era reporting holiday.

RED conformity is not Article 14

In-scope radio equipment still sits under the Radio Equipment Directive’s conformity assessment, CE marking and market-surveillance stack for the essential requirements that apply to the placement date — including RED cybersecurity while the Delegated Regulation remains in force for that placement window. Those filings go through the RED economic- operator and market-surveillance path. Article 14 filings go through ENISA’s Single Reporting Platform to a coordinating CSIRT. Keep both playbooks; do not treat a RED DoC update as an SRP substitute.

Personal data in a connected-radio incident can still raise GDPR duties for whoever is the controller — CRA vs GDPR — and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Those regimes do not replace CRA Article 14 for an in-scope radio product. Many radio/network SKUs are also Annex III important products (for example routers, modems and switches) — that changes Article 32 conformity assessment, not the Article 14 clocks; see Article 14 for important and critical products. For true CRA exclusions (where Article 14 does not attach), see Article 14 for medical devices, Article 14 for motor vehicles, Article 14 for aviation and drones and Article 14 for marine equipment.

Questions people ask

Does Wi-Fi / Bluetooth radio equipment have a CRA Article 14 reporting duty?

Yes when the product is a product with digital elements in CRA scope under Article 2(1) — and Commission FAQ 2.6.1 says the CRA applies to the categories of radio equipment covered by Delegated Regulation (EU) 2022/30 under the Radio Equipment Directive. Unlike MDR, type-approved vehicles, EASA-certified aviation products or Directive 2014/90 marine equipment, radio equipment is not carved out of the CRA by Article 2. Article 14’s 24-hour / 72-hour / final-report chain therefore runs for those in-scope radio products from 11 September 2026 (Article 71(2) / FAQ 7.1).

If we still place products under RED cybersecurity rules until December 2027, is Article 14 delayed too?

No. FAQ 2.6.1 describes a conformity transition for essential cybersecurity requirements: placements between 1 August 2025 and 10 December 2027 stay under the RED Delegated Regulation’s cyber essential requirements; placements from 11 December 2027 follow the CRA’s Annex I package once the CRA fully applies. FAQ 7.1 separately states that Article 14 reporting obligations apply from 11 September 2026 — months before that December 2027 conformity switch. Meeting RED (or EN 18031) for market placement does not postpone the SRP clocks.

Is a RED CE declaration or EN 18031 assessment the same as an ENISA SRP filing?

No. RED conformity assessment and the declaration of conformity address product cybersecurity essential requirements for placing radio equipment on the market. Article 14 is a manufacturer notification duty for actively exploited vulnerabilities and severe incidents via ENISA’s Single Reporting Platform to the coordinating CSIRT. Matching words like “cybersecurity” or “incident” across the two stacks does not merge the filings or the clocks.

What about products already on the market under the RED Delegated Regulation?

Article 14 still applies when you become aware on or after 11 September 2026 of an actively exploited vulnerability or severe incident affecting an in-scope product — including products already placed on the Union market (Article 69(3)). FAQ 7.1 also notes that EU-type examination certificates and approval decisions issued for cybersecurity under other Union harmonisation legislation such as Delegated Regulation (EU) 2022/30 remain valid until 11 June 2028 (unless they expire earlier). Certificate validity is about conformity evidence; it is not a reporting holiday.

Does GDPR or NIS2 replace Article 14 for connected radio products?

No. Personal-data breach duties under GDPR and entity-level incident duties under NIS2 are separate regimes. They can run beside Article 14 for the same event, but neither substitutes for an SRP filing when CRA Article 14 applies. See our CRA vs GDPR and CRA vs NIS2 guides for the no-substitution framing.

How is this different from medical devices, vehicles, aviation or marine equipment?

Those stacks have CRA exclusions in Article 2(2)–(4) (and FAQ 1.9): MDR/IVDR, Regulation (EU) 2019/2144 vehicles, Regulation (EU) 2018/1139 certified aviation products, and Directive 2014/90/EU marine equipment. FAQ 2.6.1 does the opposite for RED Delegated Regulation categories — it confirms the CRA applies. Map your SKU to Article 2(1) and the 2022/30 categories; do not treat “we have a RED DoC” as an Article 2 carve-out.