Legacy products (transitional provisions)
Products you already sell do not have to be brought into conformity retrospectively. The reporting obligation offers no such relief: since 11 September 2026 it has covered every product on the market, including those whose support ended long ago.
Legacy products are products with digital elements placed on the market before 11 December 2027. Under the transitional provisions in Article 69, they fall under the requirements of the Regulation only if they are substantially modified; the reporting obligation under Article 14 applies to them regardless.
Definition in the Regulation
The Regulation does not define the term as such; it describes the transitional rule in Article 69 of Regulation (EU) 2024/2847. Under that rule, products placed on the market before 11 December 2027 are subject to the requirements only if they are substantially modified from that date. The reporting obligation is the exception: under Article 69(3) and Article 71(2), Article 14 has applied to all manufacturers since 11 September 2026. The Commission guidance C(2026) 5252 confirms in paragraph 210 that the reporting obligation also covers products placed on the market before 11 December 2027 and continues to apply after the support period has ended. Under paragraph 217, there is no retroactive effect: exploitation the manufacturer was already aware of before 11 September 2026 does not have to be reported after the event.
What it means for manufacturers
For your existing portfolio, this means two things. First, if a vulnerability in an older product is actively exploited, the 24-hour deadline runs, even if the product never needed CE marking under the CRA. To be able to report, you need to know which versions are in use in which Member States. Second, an update that affects conformity, risk or intended purpose, such as a new remote connection, can be a substantial modification and bring the product fully within the Regulation; pure security fixes are not. Under Article 71(2), the fines under Article 64 apply only from 11 December 2027, but the obligation itself applies now.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Substantial modification
- Placing on the market
- Support period
- Awareness (start of the deadlines)
- Cyber Resilience Act (CRA)