CRA Article 14 vs AI Act serious-incident reporting: do you file twice?

What Article 12 actually does

CRA Article 12 and Recital 51 bridge conformity between the Cyber Resilience Act and the AI Act (Regulation (EU) 2024/1689). For products with digital elements that are also high-risk AI systems under AI Act Article 6, the product is deemed to comply with the cybersecurity requirements in AI Act Article 15 where: Annex I Part I essential cybersecurity requirements are fulfilled; manufacturer processes meet Annex I Part II; and the AI Act Article 15 cybersecurity protection level is demonstrated in the CRA EU declaration of conformity — without prejudice to AI Act accuracy and robustness requirements. Article 12(2)–(3) then allocate which conformity-assessment procedure applies (AI Act Article 43 as a rule, with a CRA procedure derogation for certain important/critical PDEs on AI Act internal control).

That is the same family of trap as EHDS Article 32(5a) or Annex III/IV class: assessment paperwork changes how you prove cybersecurity for market access. It does not rewrite Article 14. A declaration of conformity, notified-body opinion or AI regulatory sandbox participation (Article 12(4) / AI Act Article 57) is not an early warning.

Article 14 and Article 73 stay parallel

CRA Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform to the coordinating CSIRT. That duty has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

AI Act Article 73 obliges providers of high-risk AI systems placed on the Union market to report serious incidents (Article 3(49)) to the market surveillance authorities of the Member States where the incident occurred (with AI Office involvement where Article 75(1) applies). The default outer bound is not later than 15 days after awareness once a causal link or reasonable likelihood is established; two days for widespread infringement or Article 3(49)(b) incidents; ten days where a death is involved. Incomplete initial reports are allowed (Article 73(5)). Those filings do not appear in the CRA SRP workflow, and an SRP submission does not appear as an Article 73 notification.

Clock detail for the CRA side lives in the reporting deadlines and becoming-aware guides. CSIRT routing: which CSIRT applies.

The trap: “AI Act cyber presumption / Art 73 covered ENISA”

Two failure modes show up in triage. First: reading Article 12 as an Article 2-style exclusion or as a reporting merge, and skipping ENISA when an AEV or severe incident hits an in-scope AI product. Second: filing Article 73 to market surveillance and assuming the 24-hour CRA early warning can wait because “AI incident reporting is already running,” or waiting for finished Annex I / Article 12 DoC evidence before opening an SRP case. Conformity presumption and SRP are different calendars.

Neighbouring traps: Annex III/IV class (also Art 32 / certification — same Art 14 clocks; biometric IAM products can also be AI Act Annex III); MDR/IVDR exclusion (true CRA carve-out — and AI Act Article 73(10) has its own MDR/IVDR notification limit); standalone SaaS outside CRA versus a shipped AI product with remote data processing inside the product; and parallel GDPR, NIS2, or DORA filings that never close an SRP duty.

If CRA, AI Act, GDPR, NIS2 and DORA all look relevant

Run each regime's own trigger test and file to each regime's own recipient. Keep one internal timeline of what you knew and when (the evidence log), then fork the external notifications. Article 73(9)–(10) narrow AI Act serious-incident notification for some systems already covered by other Union reporting instruments (including certain MDR/IVDR cases) — those limbs do not say a CRA Article 14 SRP filing replaces Article 73 for a dual-scope high-risk AI PDE. A DORA Article 19 filing to a financial competent authority likewise does not close Article 14. Confirm any equivalent-reporting claim with counsel against the current consolidated texts.

Questions people ask

Does CRA Article 12 mean we skip Article 14 if the product is a high-risk AI system?

No. Article 12 is a conformity bridge: when a CRA-scope product is also a high-risk AI system under AI Act Article 6, meeting CRA Annex I Parts I and II and demonstrating the AI Act Article 15 cybersecurity protection level in the CRA EU declaration of conformity lets the product be deemed to comply with those AI Act cybersecurity requirements — without prejudice to AI Act accuracy and robustness. Nothing in Article 12 rewrites Article 14, the Single Reporting Platform, or the 24-hour / 72-hour clocks.

Does an AI Act Article 73 serious-incident report satisfy CRA Article 14?

No. Article 14 does not name the AI Act as an alternative route. Article 73 sends high-risk AI serious incidents to market surveillance authorities (or, where Article 75(1) applies, the AI Office). Article 14 sends actively exploited vulnerabilities and severe product-security incidents to the coordinating CSIRT and ENISA via the SRP. Different recipients, different trigger tests, different clocks. One filing does not put the report in front of the other regime.

When can the same event trigger both?

When the facts independently meet both tests. CRA Article 14 needs an actively exploited vulnerability in your product with digital elements, or a severe incident with impact on that product’s security. AI Act Article 73 needs a serious incident (Article 3(49)) involving a high-risk AI system you provide that is placed on the Union market. A security compromise of a dual-scope AI product can trip both; a product AEV with no Article 3(49) serious-incident facts may be CRA-only; a high-risk AI serious incident with no product-security AEV/severe trigger may be AI Act-only.

Are the clocks the same shape as NIS2?

No. CRA Article 14 uses 24-hour early warning, 72-hour fuller notification, then a final report. AI Act Article 73 uses a different ladder: generally not later than 15 days after awareness once a causal link (or reasonable likelihood) is established; not later than two days for widespread infringement or Article 3(49)(b) incidents; not later than 10 days where a death is involved. Matching the word “incident” across the two laws does not merge the calendars.

Our AI product is not high-risk — do we still have Article 14?

Possibly. CRA Article 14 attaches to manufacturers of in-scope products with digital elements when an AEV or severe product-security incident is met — it does not require AI Act high-risk classification. AI Act Article 73 is a high-risk provider duty. Non-high-risk AI software placed as a product can still sit in CRA Article 14 if the product tests are met, while sitting outside Article 73.

When does each duty apply on the calendar?

CRA Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)). AI Act Article 73 runs with the AI Act’s own application calendar for high-risk systems (see AI Act Article 113 and current Commission guidance). Do not wait for a finished Article 12 / Annex I conformity file — or for AI Act high-risk application — before running the SRP chain on an in-scope PDE that already meets an Article 14 trigger.