Does the CRA reporting duty apply to products sold before 2027?

Yes. Article 69(3) applies the Article 14 obligations to all in-scope products with digital elements placed on the market before 11 December 2027 — the whole installed base, from 11 September 2026.

Do legacy products have to meet the CRA's full security requirements?

Not by virtue of 69(3). Under Article 69(2), products placed before 11 December 2027 face the full requirements only upon substantial modification — but the Article 14 reporting duty applies to them regardless, as an express derogation.

Kilde › Guides › CRA › Legacy products under the CRA: why the…

Legacy products under the CRA: why the whole installed base reports from 11 September 2026

Current to 26 August 2026 · updates land in the changelog.

The single most consequential — and most missed — fact about the CRA's reporting duty: it is not limited to new products. Article 69(3) reads:

“By way of derogation from paragraph 2 of this Article, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027.”

Plainly: from 11 September 2026, the 24-hour/72-hour reporting duty covers your entire in-scope installed base — including products shipped years before the CRA existed.

The 69(2) confusion

The neighbouring paragraph, Article 69(2), is the source of a persistent misreading. 69(2) is the transitional rule under which products placed on the market before 11 December 2027 face the CRA's full requirements only if substantially modified after that date. Some summaries stop there and conclude legacy products are out. They are out of the full obligation set — but 69(3) expressly carves the Article 14 reporting duty back in, as a derogation from 69(2). Citing 69(2) for the reporting question gets the answer exactly backwards.

What this means operationally

Every in-scope product you have ever placed on the EU market is on the reporting clock from 11 September 2026 — including versions no longer sold, white-labelled units carrying your name, and hardware in the field you have stopped thinking about. The operational consequences:

Inventory first. You cannot triage awareness for products you have not listed. The installed-base inventory is the legacy duty's real deliverable.
Awareness channels reach old products. A researcher email about a 2019 device is a potential 24-hour trigger — if the exploitation evidence is there.
The duty is reporting, not redesign. 69(3) does not retroactively impose the Annex I essential requirements on legacy stock — that remains governed by 69(2) and the substantial-modification rule.

Related guides

Quick answers

Does the CRA reporting duty apply to products sold before 2027?: Yes. Article 69(3) applies the Article 14 obligations to all in-scope products with digital elements placed on the market before 11 December 2027 — the whole installed base, from 11 September 2026.
Do legacy products have to meet the CRA's full security requirements?: Not by virtue of 69(3). Under Article 69(2), products placed before 11 December 2027 face the full requirements only upon substantial modification — but the Article 14 reporting duty applies to them regardless, as an express derogation.

Be reporting-ready before 11 September 2026.

The CRA Reporting-Ready Pack: the staged 24h / 72h / final-report runbook and templates, vulnerability-vs-incident triage worksheet, CSIRT-routing and main-establishment worksheet, platform registration runbook, CVD policy and evidence log — built from the regulation and the ENISA platform guides, with pinpoint citations.

Get the pack — US$390 Free 4-page sample (PDF)

Instant download · 14-day unconditional refund · single-organisation licence · full product page

General information only — not legal advice, and never a conformity assessment. Whether a specific product falls in a listed category is decided against the binding technical descriptions in Implementing Regulation (EU) 2025/2392, and reporting-platform mechanics are ENISA-published material marked subject to change. Sources are Regulation (EU) 2024/2847 (CELEX 32024R2847; Annex III/IV item texts read verbatim from EUR-Lex) and our audited kit research. © 2026 Kilde.

Built by Kilde's founder, a practising attorney admitted to a US state bar (not an EU or Hong Kong admission). About · Verification log · Refunds · Terms · Privacy · esau@trykilde.com