What Articles 28–30, 32 and 71 actually say
Article 71(2) is explicit: this Regulation applies from 11 December 2027; however, Article 14 applies from 11 September 2026 and Chapter IV (Articles 35 to 51 — notifying authorities and conformity assessment bodies) from 11 June 2026. Recital 126 repeats the same split. Commission FAQ 7.1 puts it in plain terms: reporting obligations in Article 14 from 11 September 2026; manufacturer obligations to ensure conformity with Annex I essential cybersecurity requirements, market surveillance and enforcement, and the other CRA provisions from 11 December 2027.
Article 28: manufacturers draw up an EU declaration of conformity in accordance with Article 13(12) stating that fulfilment of the applicable Annex I essential cybersecurity requirements has been demonstrated; the DoC follows Annex V (simplified form Annex VI); where several Union acts apply, a single declaration may cover them all; by drawing it up the manufacturer assumes responsibility for compliance. Articles 29–30 tie the CE marking to that conformity framework and require it to be affixed before the product is placed on the market (with software placement rules on the DoC or an easily accessible website). Article 32 sets the conformity assessment procedures, including stricter routes for important and critical products. None of those articles say “complete DoC / CE / notified body before Article 14 starts.”
Article 14 does not wait for market-access paperwork
Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product with digital elements — simultaneously to the coordinating CSIRT and ENISA — through the Single Reporting Platform: early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger. The duty attaches to the manufacturer and to CRA product scope, not to whether Annex I conformity has been demonstrated yet. Clock detail: Article 14 reporting deadlines.
Article 69(3) keeps Article 14 on in-scope products already placed before 11 December 2027 — the same products that often have no CRA DoC yet. FAQ 5.3 adds that you may still have to notify even when full investigation or vulnerability handling is impractical. Legacy framing: Article 14 for legacy products. Vulnerability-handling process (Article 13 / Annex I Part II) is a related Dec 2027 package, not the SRP: Article 14 vs Article 13 vulnerability handling.
The trap: “no CRA CE / DoC yet, so we cannot report”
Three failure modes show up in triage. First: programme plans put CE marking, technical documentation and notified-body slots on the critical path and treat ENISA as a 2027 go-live. Article 71(2) already flipped reporting on. Second: teams confuse Chapter IV’s early application (bodies designated from 11 June 2026) with a rule that assessment must finish before any SRP case — assessment readiness is not an Article 14 precondition. Important/critical class only changes Article 32 routes, not the clocks: important and critical products.
Third: the reverse error — treating an SRP final report as proof the product is CRA- conformant for placement. Filing closes a reporting chain; it does not draw up an Article 28 declaration or affix a CRA CE mark. EHDS products that swap assessment procedure under Article 32(5a) still face the same Article 14 clocks: EHDS EHR systems. Other-regime CE marks (for example RED during the 2022/30 bridge) likewise do not file Article 14: radio equipment / RED.
Keep reporting and conformity on separate lines
| Track | Main instruments | Live for manufacturers from |
|---|---|---|
| Reporting | Art 14 + Art 16 SRP | 11 September 2026 (Art 71(2)) |
| CAB framework | Chapter IV (Arts 35–51) | 11 June 2026 (bodies / notifying) |
| Conformity / CE / DoC | Annex I + Arts 28–32 (+ MSA) | Generally 11 December 2027 (FAQ 7.1) |
Before the next exploited vulnerability: know who the manufacturer is, which CSIRT end- point Article 14(7) points to, who holds SRP Assigned Representative access, and how you timestamp awareness — even if the CRA DoC folder is still empty. Practice the chain on the free desk; filing still goes through ENISA.
Questions people ask
- Do we need a CRA CE mark before we can file Article 14?
- No. Article 14 has applied from 11 September 2026 under Article 71(2) / Recital 126. Affixing the CE marking under Articles 29–30 is part of the market-access / conformity stack that generally applies from 11 December 2027 with Annex I essential requirements (Commission FAQ 7.1). Missing a CRA CE mark does not pause the 24-hour early warning.
- Does the EU declaration of conformity replace an ENISA SRP filing?
- No. Article 28 requires manufacturers to draw up an EU declaration of conformity stating that fulfilment of the applicable Annex I essential cybersecurity requirements has been demonstrated, and by doing so they assume responsibility for compliance. That is placement / conformity paperwork. Article 14 is a separate awareness-triggered duty to notify actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform. A signed DoC is not an early warning.
- We are still in conformity assessment / waiting for a notified body. Can Article 14 wait?
- No for in-scope products once you become aware. Article 32 and Chapter IV set conformity-assessment routes (including notified-body involvement for important/critical classes). Chapter IV already applies from 11 June 2026 so bodies can be designated, but that calendar does not rewrite Article 14’s 24-hour / 72-hour / final-report chain from 11 September 2026. See our important/critical-products guide for class vs reporting.
- Our product was placed before 11 December 2027 and has no CRA DoC. Do we still report?
- Yes when the product is in CRA scope. Article 69(3) applies Article 14 reporting to products with digital elements placed on the market before 11 December 2027. FAQ 7.1 and FAQ 5.3 keep the same split: reporting now; full Annex I conformity package later (with the legacy and substantial-modification rules for other duties). See the legacy-products guide.
- If we already have CE marking under RED or another regime, are we done for Article 14?
- No. A CE mark under other Union harmonisation legislation (for example radio equipment during the Delegated Regulation (EU) 2022/30 bridge) is not an ENISA SRP submission. Article 14 still runs on its own clocks for in-scope products. See the radio-equipment and reporting-deadlines guides.
- Does filing Article 14 mean we have completed CRA conformity?
- No — the opposite trap. An SRP early warning, 72-hour notification or final report does not draw up an Article 28 declaration, affix a CRA CE mark, or finish Article 32 assessment. Keep reporting and market-access workstreams on separate checklists.