CRA Article 14 vs Product Liability Directive (2024/2853): reporting ≠ compensation

What the new Product Liability Directive actually does

Directive (EU) 2024/2853 replaces the 1985 product-liability regime for products placed on the market or put into service after 9 December 2026. PLD Article 1 sets common rules on liability of economic operators for damage suffered by natural persons and caused by defective products, and on compensation for that damage. Article 4(1) expressly includes software in “product”. Article 5 gives injured persons a right to compensation; Article 6 lists compensable damage (death or personal injury, certain non-professional property damage, and destruction or corruption of data not used for professional purposes).

Defectiveness is a safety test, not a “was there a CVE” test. Under Article 7, a product is defective where it does not provide the safety a person is entitled to expect or that Union or national law requires — assessed against all circumstances, including safety-relevant cybersecurity requirements (Article 7(2)(f)). Recital 32 of the Directive adds that a product can be found defective on account of its cybersecurity vulnerability, for example where it does not fulfil safety-relevant cybersecurity requirements.

CRA Article 1 and Article 14 stay on the product / SRP track

CRA Article 1 is the subject-matter spine of Regulation (EU) 2024/2847: rules for making products with digital elements available on the market; essential cybersecurity requirements for design, development, production and vulnerability handling; and market surveillance. That package is about placing secure products and handling vulnerabilities — not about paying civil compensation to injured natural persons.

Inside that package, Article 14 obliges manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of the product — early warning within 24 hours of becoming aware, fuller notification within 72 hours, then the final report on its own trigger — through ENISA's Single Reporting Platform to the coordinating CSIRT. That duty has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)).

Clock detail lives in the reporting deadlines and becoming-aware guides. Support-period and update context: Article 14 after the support period ends.

FAQ 2.3.1 and Recital 31: complementary, not a merge

Commission FAQ 2.3.1 is blunt: the CRA and the Product Liability Directive are of a different nature; they complement each other; there is no legal overlap. The PLD is about compensation for damage from defective products under strict liability. Defectiveness takes cybersecurity requirements into account. The CRA supplies concrete manufacturer duties — for example Annex I security updates — while the PLD does not itself impose a substantive update obligation, yet still leaves the manufacturer exposed for defects introduced by an update or arising from the lack of one.

CRA Recital 31 says the same complementarity from the CRA side: Directive (EU) 2024/2853 is complementary; where a lack of safety consists in a lack of security updates after placing on the market and that causes damage, manufacturer liability under the Directive could be triggered; the CRA is where the update obligations themselves are laid down.

The trap: “liability / insurance covered ENISA”

Two failure modes show up in triage. First: counsel or insurers open a PLD-shaped claim file (or a holdback under the old 85/374 regime for pre-December 2026 placements) and the security team treats that as the only clock that matters. Second: the team assumes that because the new PLD now names software and safety-relevant cybersecurity in the defectiveness test, finishing CRA conformity work — or waiting for national transposition on 9 December 2026 — pauses Article 14. Civil liability exposure and SRP reporting are different jobs.

Neighbouring traps: parallel GDPR personal-data breach clocks; NIS2 and DORA entity ICT filings; AI Act Article 73 market-surveillance serious-incident filings; consumer-safety dual scope under GPSR; and Data Act access duties under FAQ 2.9. None of those is a Product Liability Directive substitute for the SRP either.

If CRA reporting and a PLD (or insurance) track both look relevant

Run each regime's own trigger test. When the facts meet Article 14, open the SRP chain on the CRA calendar. Separately, counsel and insurers assess whether a defective product caused compensable damage under the applicable liability rules — new PLD for post-9 December 2026 placements, or the prior regime for earlier ones. Keep one internal timeline of what you knew and when (the evidence log), then fork regulatory notifications from civil / insurance handling. Confirm any “one filing covers both” claim with counsel against the Official Journal texts — do not invent a CRA exemption from a liability file.

Questions people ask

Does a Product Liability Directive claim or settlement replace CRA Article 14?

No. Commission FAQ 2.3.1 says the CRA and Directive (EU) 2024/2853 (the new Product Liability Directive) are of a different nature and, while they complement each other, there is no legal overlap. The PLD sets strict-liability compensation rules when a defective product causes damage to a natural person. Article 14 sends actively exploited vulnerabilities and severe product-security incidents from manufacturers to the coordinating CSIRT and ENISA via the Single Reporting Platform. Paying or defending a civil claim is not an SRP early warning.

How does CRA Article 1 relate to the PLD?

CRA Article 1 is the subject-matter clause for the Cyber Resilience Act: rules for making products with digital elements available on the market, essential cybersecurity requirements (including vulnerability handling), and market surveillance. PLD Article 1 is a different subject matter — common rules on liability of economic operators for damage caused by defective products and on compensation. CRA Recital 31 expressly calls Directive (EU) 2024/2853 complementary to the CRA: the Directive can trigger manufacturer liability where a lack of safety consists in a lack of security updates that causes damage, while the CRA lays down the update obligations themselves.

Can a cybersecurity vulnerability make a product “defective” under the new PLD?

Yes in principle. PLD Article 7(1) treats a product as defective where it does not provide the safety a person is entitled to expect or that is required under Union or national law. Article 7(2)(f) requires the defectiveness assessment to take into account relevant product safety requirements, including safety-relevant cybersecurity requirements. FAQ 2.3.1 likewise says defectiveness must be assessed taking into consideration all circumstances, including cybersecurity requirements — and points to CRA Annex I security-update duties as an example of CRA manufacturer obligations that sit beside PLD liability.

If we miss a security update, are we automatically off the hook under the PLD later-defect defence?

Not when the gap stays inside the manufacturer’s control. PLD Article 11(1)(c) normally lets an operator argue that defectiveness came into being after placing on the market or putting into service. Article 11(2) removes that exemption where defectiveness is due to software (including updates or upgrades), a related service, a lack of software updates or upgrades necessary to maintain safety, or a substantial modification — provided it is within the manufacturer’s control. FAQ 2.3.1 adds that the PLD itself imposes no substantive obligation to update, but the manufacturer remains liable for defects introduced by an update or arising from the lack of one. That liability track still does not rewrite Article 14.

Does filing Article 14 (or having a CE / CRA file) immunise us from PLD claims?

No. Article 14 is a regulatory notification duty to CSIRT and ENISA. PLD Articles 5–7 are about compensation for death, personal injury, certain property damage and non-professional data destruction or corruption caused by a defective product. Completing an SRP chain, keeping an evidence log, or arguing conformity with CRA essential requirements may be relevant evidence in a later civil case — counsel decides — but none of those steps is a statutory bar to a PLD claim, and a PLD claim is not an alternative route into the SRP.

When does each instrument apply on the calendar?

CRA Article 14 has applied from 11 September 2026 (Article 71(2)), including for in-scope products already on the market (Article 69(3)). The new PLD applies to products placed on the market or put into service after 9 December 2026 (PLD Article 2(1)); Member States must transpose by that same date, 9 December 2026 (PLD Article 22), and Directive 85/374/EEC continues for earlier placements, repealed with effect from 9 December 2026 (PLD Article 21). Do not wait for national PLD transposition — or for a finished civil-claim file — before opening an SRP case when an Article 14 trigger is already met.