CRA Article 14 for spare parts: Article 2(6) identical-parts exclusion vs reporting

What Article 2(6) actually excludes

Article 2(1) brings in products with digital elements made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Article 2(6) then carves out spare parts made available on the market to replace identical components in products with digital elements and manufactured according to the same specifications as the components they are intended to replace. Recital 29 states that this covers both spare parts for products made available before the CRA applied and spare parts that have already undergone a CRA conformity assessment.

Commission guidance on the application of the CRA (C(2026) 5252 final, section 4.2 / §96–98) narrows the operational test: the exemption applies only where the part is specifically supplied to repair or extend the durability of a product already placed on the market (before or after 11 December 2027). A standalone sale with no repair connection is ordinary placing on the market. Keep order, offer or after-sales evidence — market surveillance can ask for it.

When Article 14 does — and does not — attach

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks only exist for products inside CRA scope. A qualifying Article 2(6) spare part is outside scope, so that part itself has no SRP duty.

Two traps sit next to that clean rule. First, a non-identical replacement is a product with digital elements in its own right (guidance §101 / Example 37) — once awareness and the actively-exploited or severe-incident tests are met, Article 14 runs for that replacement from 11 September 2026 (Article 71(2)), including where it is meant to keep an older host product alive. Second, excluding the spare part does not pause Article 14 for an in-scope finished product still on the Union market — including legacy products and lines past their support period. Keep the Article 14 reporting deadlines and becoming-aware rules ready for every SKU that is still in scope.

The trap: “it's a spare part, so SRP can wait”

Service and logistics teams often label anything shipped through an after-sales channel as a spare part. Guidance §97 rejects that shortcut: the repair purpose must be apparent from the supply context, and §99–100 test identicalness against cybersecurity-relevant characteristics, not catalogue wording. A drop-in module with new crypto, a different secure-boot chain, or changed access-control features is typically not Article 2(6) stock — it is a CRA product, and Article 14 can start on awareness of active exploitation or a severe incident affecting it.

Inventory each after-sales SKU: whether it is an identical-specification repair part, whether a companion app or cloud backend meets remote data processing under Article 3(2), and who is the manufacturer under brand-under-name rules. White-label or retailer branding does not by itself create a spare-parts reporting holiday.

Repair conformity is not Article 14

Physical repair and refurbishment that do not amount to a substantial modification sit in guidance section 4.1 — a different analysis from Article 2(6). Neither a repair ticket nor a “spare parts” invoice files or replaces an ENISA Single Reporting Platform notification when the product (or non-identical replacement) is in CRA scope. Keep both playbooks — and when a change does meet Article 3(30), see Article 14 after a substantial modification.

Personal data in a connected-product incident can still raise GDPR duties for whoever is the controller — CRA vs GDPR — and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Those regimes do not replace CRA Article 14 for an in-scope product. For product-class CRA exclusions (where Article 14 does not attach to the finished item), see Article 14 for medical devices, Article 14 for motor vehicles, Article 14 for aviation and drones and Article 14 for marine equipment. Exclusive national-security or defence builds and classified-information products are a separate Article 2(7) carve-out — dual-use market SKUs stay in; see Article 14 for national security and defence.

Questions people ask

Do spare parts have a CRA Article 14 reporting duty?

Not when they fall inside Article 2(6): spare parts made available on the market to replace identical components in products with digital elements and manufactured according to the same specifications as the components they replace. Recital 29 and Commission guidance C(2026) 5252 §96–98 confirm that exemption. Outside the CRA, that spare part itself has no Article 14 early warning, 72-hour notification or final report through ENISA’s Single Reporting Platform.

Is “same function” or “compatible drop-in” enough for the spare-parts exclusion?

No. Guidance §97 says technical suitability alone is not enough — the part must be specifically supplied to repair or extend the durability of a product already placed on the market, with that repair purpose apparent from the supply context (order, commercial offer, after-sales channel) and evidence kept for market surveillance. Guidance §99–100 then tests “identical” against functional role and cybersecurity-relevant characteristics. Differences in algorithms, protocols, cryptographic mechanisms, access controls or other security-relevant characteristics can defeat the exemption (§100 / Example 37).

What if we ship a newer chip or module because the original is obsolete?

Treat it as a case-by-case identicalness test, not an automatic holiday. Guidance Example 37: a newer chip with equivalent functionality but a different cryptographic implementation and updated secure boot is not identical — it is a product with digital elements in its own right and subject to the CRA (and therefore Article 14 when awareness and the AEV / severe-incident tests are met). Example 38: a different chipset with the same protocols and security mechanisms, and firmware that does not alter security-relevant characteristics, can still count as identical and stay under Article 2(6).

If the spare part is out of CRA, does the finished product still report under Article 14?

Often yes. Article 2(6) removes the qualifying spare part from CRA scope; it does not cancel Article 14 for an in-scope finished product that still sits on the Union market. When you become aware of an actively exploited vulnerability or severe incident affecting that product, the manufacturer’s Article 14 chain still runs from 11 September 2026 (Article 71(2) / 69(3)) — including for legacy and end-of-support catalogues. See our legacy-products and after-support-period guides.

Does GDPR or NIS2 replace Article 14 for non-identical replacement parts?

No. Personal-data breach duties under GDPR and entity-level incident duties under NIS2 are separate regimes. They can run beside Article 14 for the same event when a non-identical replacement is in CRA scope, but neither substitutes for an SRP filing. See our CRA vs GDPR and CRA vs NIS2 guides.

How is this different from medical devices, vehicles, aviation or marine equipment?

Those are product-class exclusions in Article 2(2)–(4) (FAQ 1.9). Article 2(6) is a spare-parts exclusion that turns on identical replacement for repair — not on MDR, type-approval, EASA certification or Directive 2014/90. Map the SKU to the identical-specification and repair-supply tests before you assume Article 14 is off.