When Support Ends and Article 14 Keeps Running
A new dossier with every issue. Today we cover what happens to the Article 14 reporting duty after a product’s support period ends.
The Commission’s adopted guidance on the Cyber Resilience Act says the Article 14 reporting duty carries on after support ends.
Issue 1 of The CRA Fringe flagged this as the open issue that came as a surprise, and promised that later issues would go there. This is that issue, and the first to work from the fringe itself: a duty that applies to a product the manufacturer no longer supports, and no settled answer on where it ends.
This issue’s dossier
Article 14 Reporting beyond the Support Period argues that a manufacturer’s duty to report an actively exploited vulnerability outlasts the product’s support period. It is written for General Counsel and Compliance Leads, the people who decide whether a discontinued product’s reporting duty has actually ended.
You can get the dossier at comply.land/dossiers/cra-reporting-after-support-period.
The argument starts with the text. Article 14 ties the duty to a manufacturer becoming aware of an actively exploited vulnerability and gives it no end date. Article 69’s transitional rules extend it to products placed on the market before the Regulation’s general application date, a class of products not subject to the CRA’s support-period requirements.
The dossier then argues that the duty’s only real endpoint is the manufacturer’s own existence as a legal entity. To build the case it tests seven candidate limiters in the Regulation’s text, none of which bounds the duty, and reads the question across the wider EU product-safety framework, including NIS2, and DORA. No regime compares ties reporting to a support period that the manufacturer declares for itself.
Reporting and repair come apart in this reading. Article 14 is an informational duty, and the vulnerability-handling and repair obligations sit elsewhere in the Regulation. Support ends and the patches stop, while the duty to report keeps going.
A market surveillance authority has its own reach. Articles 54 and 57 let it compel action on an unsupported product even where the manufacturer’s own duty has lapsed.
On this reading no product ever leaves the reporting duty while its manufacturer exists.
Where the argument can be tested
The dossier presents itself as a doctrinal position and sets its own reading against the strongest objections, proportionality and legal certainty. The Commission’s guidance is non-binding and only the Court of Justice can authoritatively interpret the Regulation, so the dossier says plainly what remains unresolved. It also sets out six operational recommendations, including how to draft a report on an unsupported product that limits exposure to an Article 57 order.
Like every dossier in the series, it is neither legal advice nor a conformity determination.
What comes next
Issue 3 will introduce the next dossier. Which clause does your team read differently every time it comes up?
