Qualify Legacy Products Before the September 2026 CRA Deadline

The authors of this blog participate in the EU-funded project CRACY, helping SMEs understand cybersecurity and comply with the Cyber Resilience Act. 

Many manufacturers are fixated on the December 2027 Cyber Resilience Act (CRA) deadline, because that is when the Regulation becomes fully applicable. In focusing on the later date, they risk missing an earlier one. A central part of the CRA, the notification duties under Article 14, kicks in well before: on 11 September 2026. From that date you must be ready to report actively exploited vulnerabilities and severe incidents affecting your existing products with digital elements (PDEs). To do that, you first need to know whether your existing products qualify as PDEs at all. 

What tends to catch manufacturers off guard is that this is not limited to products placed on the market after the reporting duties start. Legacy products are in scope too. By way of derogation from the general transitional rule in Article 69(2) CRA, Article 69(3) makes the Article 14 reporting obligations apply from 11 September 2026 to all in-scope products already on the market, regardless of when they were first placed there. The Commission's FAQ on Article 14 confirms this. 

What actually needs to be reported 

From 11 September 2026 you must notify two types of event: actively exploited vulnerabilities in your products with digital elements, and severe incidents affecting the security of those products. The process runs in stages: an early warning within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report afterwards. The deadline for that final report depends on what is being managed. For a vulnerability, within 14 days of a corrective or mitigating measure becoming available and for a severe incident, within one month of the 72-hour notification. 

We set out the specific reporting steps in our previous blog post on what it means to be subject to incident notification. 

Remember that this covers products already on the market, not just new launches after 11 September 2026. This means you need to have worked out which of your products qualify as PDEs well before you become aware of any reportable event. 

Where things stand with the Single Reporting Platform 

Notifications will be filed through the Single Reporting Platform (SRP) that ENISA is building. According to the Commission's reporting page, the platform is expected to be operational by 11 September 2026, with a testing period beforehand. The SRP is a single-entry point, meaning that you report once, and the notification is routed to the relevant national CSIRT and to ENISA. ENISA has said that manuals, access instructions, training materials and dry-run support will be published in June 2026. 

Useful as that is, it remains up to you as a manufacturer to qualify your products as PDEs, build the escalation process, and assess whether incidents are severe. You have to make and document these decisions yourself, and you should do so now. 

What you should be doing right now 

If you make hardware or software that could fall within the definition of a product with digital elements, you should go through your portfolio now and work out where you stand. If you have not started, you should start immediately. Non-compliance with the reporting obligations is subject to the highest category of fines in the CRA. Manufacturers could be subjected to fines of up to EUR 15.000.000 or up to 2,5% of its worldwide annual turnover for the preceding financial year, whichever is higher. However, it should be noted that these fines will only start applying after 11 December 2027, and that Member States need to designate a competent market surveillance authority for the fine regime to become actionable. 

By September 2026 you need to be able to answer: 

• Which products qualify as PDEs? 
• Which remote data processing components form part of those products? 
• Who is the manufacturer for each one? 
• Is there a means to contact the users of the PDEs? 
• How does escalation work across your technical, legal, product, support and management functions, and can it realistically happen within 24 hours? 

This is not just a legal classification exercise. A notification process, reporting templates, escalation rules, clear product ownership, vulnerability-intake procedures, and a plan for communicating with users are all part of a broader operational readiness exercise. 

A manufacturer who discovers a reportable vulnerability in September 2026 will not have time to first work out whether the product is even covered. That groundwork has to happen today. 

How Timelex can help 

We help manufacturers qualify their products, determine whether legacy products fall under the CRA's notification regime, and put the internal governance in place to report on time. 

Not sure whether your legacy products fall under the CRA's reporting regime? We run a focused legacy-product scoping exercise that identifies which products qualify as PDEs and where your 11 September 2026 readiness gaps lie. Contact Pedro Demolder (pedro.demolder@timelex.eu) or Wout Platteau (wout.platteau@timelex.eu), to get the qualification work done before the deadline forces it.