Reporting applies earlier than the main product requirements
The CRA's Article 14 reporting obligations began on 11 September 2026, while the broader main cybersecurity requirements apply later. European Commission guidance explains that the reporting obligations apply to products with digital elements within scope, including products placed on the market before 11 December 2027.
Why legacy products create operational risk
Older products can be harder to investigate quickly: build environments may be unavailable, dependencies may have changed, and the staff who knew the original product may no longer be present. That makes inventory, ownership and evidence preparation particularly important.
What manufacturers should know now
Teams should not assume that a product is outside Article 14 reporting merely because it was launched before the main 2027 application date. Scope and legal classification should be reviewed against the regulation and current official guidance.
Official guidance: European Commission CRA summary