Skip to content
CRA Reporting Desk

CRA Article 14 after a substantial modification: who reports?

Teams hear "substantial modification" and invent two wrong holidays: that Article 14 waits until you ship a big update, or that only the original OEM ever files. Article 3(30) and Recitals 38–39 define the change test; Articles 21 and 22 can make a modifier the manufacturer for Articles 13 and 14; and Article 69(3) keeps reporting live for in-scope products even when Article 69(2) still grandfathers the wider CRA package.

The short version

  • Article 14 does not wait for a substantial modification. For in-scope products it runs from 11 September 2026 (Article 71(2) / 69(3)), including pre-11 Dec 2027 placements.
  • Article 3(30): post-placing change that affects Annex I Part I compliance or changes the assessed intended purpose.
  • Recital 39: risk-reducing security updates (no purpose change) usually are not substantial; feature updates that broaden attack surface can be.
  • Articles 21–22: importer/distributor or other modifier who substantially modifies and makes available → treated as manufacturer for Articles 13 and 14 (part or whole product under Article 22(2)).
Track your Article 14 clockOpen the deadline calculator

What Article 3(30) actually tests

Article 3(30) defines a substantial modification as a change to the product with digital elements following its placing on the market that either affects compliance with the essential cybersecurity requirements in Part I of Annex I, or results in a modification to the intended purpose for which the product was assessed. Recital 38 adds the risk-assessment lens: physical or digital changes not foreseen in the initial risk assessment that may mean the product no longer meets those essential requirements should be treated as substantial. Ordinary repairs can stay outside that line when they do not affect compliance or change the assessed intended purpose.

Recital 39 is the software playbook teams actually search for. A software update is substantial where it modifies the intended purpose in a way not foreseen in the initial risk assessment, or where the nature of the hazard has changed or the level of cybersecurity risk has increased, and the updated version is made available on the market. A security update designed only to decrease risk, without changing intended purpose, is not a substantial modification — including typical minor patches for a known vulnerability. Minor UI/functionality updates usually are not either. Feature updates that change original intended functions or performance and meet the risk/purpose criteria are — and it does not matter whether the feature ships alone or bundled with a security fix.

Article 14 clocks are separate from the modification test

Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform. Those clocks attach when you are the manufacturer of an in-scope product and awareness hits. They do not require a prior substantial modification. Article 69(2) says products placed before 11 December 2027 face the wider CRA requirements only if substantially modified from that date; Article 69(3) derogates so Article 14 still applies to those placements. Commission FAQ 1.4 walks the smart-TV example (bugfix ≠ substantial; later smart-home control feature can be) and then points straight at the Article 14 derogation. FAQ 5.3 repeats the reporting rule for legacy stock.

Keep the Article 14 reporting deadlines, becoming-aware and legacy-products guides ready even when your 2027 conformity programme still treats the SKU as grandfathered.

The trap: “no substantial mod, so SRP can wait”

Product and release teams often treat “not a substantial modification” as a reporting off-switch. That confuses Article 69(2) grandfathering with Article 69(3) reporting. A catalogue line that only receives Recital 39-style security patches can still trigger a full 24-hour / 72-hour chain the day you become aware of active exploitation or a severe incident. Conversely, shipping a substantial feature update does not invent a new Article 14 calendar — it can change who owes the duty and whether the wider CRA package attaches after 11 December 2027.

Who becomes the manufacturer: Articles 21 and 22

Article 21: an importer or distributor that places a product under its own name or trademark, or that carries out a substantial modification of a product already placed on the market, shall be considered a manufacturer and shall be subject to Articles 13 and 14. Article 22(1): any other natural or legal person (not the manufacturer, importer or distributor) that substantially modifies a product and makes it available on the market is likewise considered a manufacturer. Article 22(2): those Article 13 and 14 obligations cover the part affected by the substantial modification — or the entire product if the modification impacts cybersecurity of the product as a whole.

That is the integrator / custom-firmware / “we only flashed it” trap. Brand-under-name chains can already sit in Article 3(13) without a modification — see white-label and OEM/ODM and importers and distributors. Articles 21 and 22 are not in the Article 14 early-apply carve-out in Article 71(2); confirm with counsel when those reclassification rules bind your exact chain versus the live manufacturer Article 14 clocks from 11 September 2026.

Repair, spare parts and other regimes are not substitutes

Recital 42: refurbishment, maintenance and repair under the Ecodesign for Sustainable Products Regulation definitions do not necessarily amount to a substantial modification when intended purpose, functionalities and risk level stay unaffected — but a manufacturer upgrade can. Identical repair spare parts under Article 2(6) can leave the CRA entirely; non-identical replacements usually do not — see Article 14 for spare parts. Personal data in a connected-product incident can still raise GDPR duties (CRA vs GDPR), and some manufacturers also sit in NIS2 sectors (CRA vs NIS2). Neither replaces an SRP filing for an in-scope manufacturer product. Connected machinery can also sit in dual CRA + Machinery Regulation scope (FAQ 2.4) — see Article 14 for machinery.

Questions people ask

Does a substantial modification start CRA Article 14 reporting?
Not by itself. Article 14 already applies from 11 September 2026 to in-scope products on the Union market — including products placed before 11 December 2027 — under Article 69(3) and Article 71(2). You do not wait for a substantial modification before the 24-hour / 72-hour SRP chain can run. What a substantial modification can do is reclassify who is the manufacturer (Articles 21 and 22) and, from 11 December 2027, pull a grandfathered product into the wider CRA conformity package (Article 69(2)).
What is a substantial modification under Article 3(30)?
A change to the product with digital elements after it has been placed on the market that either (1) affects compliance with the essential cybersecurity requirements in Annex I Part I, or (2) modifies the intended purpose for which the product was assessed. Recital 39 reads software changes through intended-purpose shifts and increases in cybersecurity risk (or a change in the nature of the hazard) when the updated version is made available on the market — especially where that risk was not covered in the initial risk assessment.
Is a security update a substantial modification?
Usually no, when it is designed to decrease cybersecurity risk and does not modify the intended purpose. Recital 39 says that is not a substantial modification, including typical minor source-code adjustments that only address a known vulnerability. Minor UI/functionality tweaks (new pictograms, languages) are generally not substantial either. Feature updates that change original intended functions or performance and broaden the attack surface can be substantial — and bundling them with a security patch does not save the analysis.
If we substantially modify someone else’s product, do we owe Article 14?
Often yes for the affected part — or the whole product if cybersecurity of the whole is impacted. Article 21 treats an importer or distributor that substantially modifies a product already placed on the market as a manufacturer subject to Articles 13 and 14. Article 22 does the same for any other natural or legal person who substantially modifies and makes the product available on the market. Confirm with counsel how Articles 21 and 22’s own application date (outside the Article 14 early-apply carve-out) interacts with live Article 14 clocks for your chain.
If we have not substantially modified a legacy product, are we free of Article 14?
No. Article 69(2) delays many CRA product requirements until a substantial modification after 11 December 2027. Article 69(3) derogates for Article 14: reporting still applies to in-scope products placed before that date. Commission FAQ 1.4 and FAQ 5.3 repeat that split. See our legacy-products guide.
How is this different from identical spare parts or white-label rebrands?
Article 2(6) can take identical repair spare parts out of CRA scope entirely. A white-label brand can already be the manufacturer under Article 3(13) without any modification. Substantial modification is a different trigger: it asks whether a post-placing change meets Article 3(30), and whether Articles 21/22 reclassify the modifier. Map the SKU before you assume a reporting holiday.

Track Article 14 whether or not the release was “substantial”

Use the free desk or deadline calculator for 24-hour, 72-hour and final-report dates on in-scope products — including legacy stock that has only had security patches, and builds where a modifier may now be the manufacturer under Articles 21–22. No sign-up; data stays in your browser. Official CRA filing still goes through ENISA.

Track your Article 14 clockOpen the deadline calculator

Workflow support, not legal advice. Whether a given change is a substantial modification under Article 3(30) and Recitals 38–39/41–42, who is the manufacturer under Articles 3(13), 21 or 22, how Articles 21–22 application dates interact with Article 14, and which clocks run for a security event are determinations for qualified counsel. Claims above track Regulation (EU) 2024/2847 Articles 3(30), 14, 21, 22, 69(2)–(3) and 71(2), Recitals 38–39 and 41–42, and Commission FAQ 1.4 / 5.3 as reproduced on the ORC WG / Springlex mirrors. Confirm against the Official Journal text (CRA on EUR-Lex) and the Commission FAQ before relying on this for a live case.