Article 69

A substantially modified product made available on the market counts as newly placed on the market. A third party carrying out a substantial modification becomes the manufacturer (Arts. 21/22) — but only for the modified part where the modification does not affect the product's cybersecurity as a whole. The original manufacturer may reuse documentation and tests for unchanged parts.

Key takeaways

• Distinguish integration: assembling components into a new product of one's own makes the integrator a regular manufacturer of the whole product — not a substantial modifier of others' products (Example 51).
• Legacy products: a substantial modification after 11 December 2027 of a product placed on the market before that date makes the modifier its manufacturer (Art. 69(2)) — with obligations limited to the modified parts as long as the product's overall cybersecurity is unaffected.
• The original manufacturer's obligations for the original product (vulnerability handling, compliance of unchanged parts) continue to apply.
• Conformity assessment focuses on the modified parts; existing tests and documentation may be reused for unchanged parts.

The Article 14 reporting obligations apply from 11 September 2026 to all products within the CRA's scope — including products placed on the market before 11 December 2027 and products past their support period. 'Becoming aware' means reaching a reasonable degree of certainty after an immediate initial assessment — from that moment the deadlines run (24h early warning, 72h notification, 14 days / 1 month final report).

Key takeaways

• No retroactive reporting: active exploitation the manufacturer already knew about before 11 Sep 2026 is not reportable; where exploitation only becomes known afterwards, the obligation applies.
• Third-party components: only an actively exploited vulnerability that is exploitable/exploited in the manufacturer's own product is reportable — otherwise voluntary reporting (Art. 15) plus upstream reporting to the component maintainer (Art. 13(6)).
• 'Becoming aware' is deliberately aligned with the NIS 2 implementing regulation and the GDPR breach-notification guidelines.
• Informing users (Art. 14(8)) is risk-based: no indiscriminate disclosure — for sensitive environments, detailed information may be limited to affected users; broader disclosure once fixed, and mandatory disclosure of fixed vulnerabilities under Annex I Part II point (4).
• Unlike vulnerability handling, the reporting obligations continue to apply after the support period ends.

Vehicle components (Regulation (EU) 2019/2144, Regulation (EU) No 168/2013) are exempt from the CRA where they are exclusively designed, constructed and suitable for integration into such vehicles — generic components sold through open distribution channels fall within the CRA regardless of intended-use statements. EU type-examination certificates covering cybersecurity requirements (e.g. RED Delegated Act, Machinery Regulation) remain usable as evidence of conformity for the covered risks until 11 June 2028 at the latest.

Key takeaways

• The objective conditions of supply are decisive: sale through general retail/online channels open to the public argues against the vehicle exemption; restricted B2B channels within the automotive supply chain support it.
• Existing certificates (RED DA, Machinery Regulation Annex III 1.1.9/1.2.1) do not replace the CRA risk assessment — they only serve as evidence for the risks they cover.
• CRA risks not covered by the certificate (e.g. vulnerability handling processes, data minimisation, attack surface reduction) must be addressed additionally.

They are generally exempt from retroactive CRA scope. But the vulnerability reporting obligation under Article 14 from September 11, 2026 also applies to these products if actively exploited vulnerabilities exist.

A change that affects compliance with the regulation or alters the intended use. Security updates and bug fixes explicitly do not count as substantial modifications. Functional changes or new interfaces do.

No — only if they are placed on the market again after the deadline or undergo a substantial modification. However, for stock sold after December 11, 2027, the CRA does apply — the 'placed on market before deadline' clause does not cover 'made available on the market'.