CRA for existing products already on the EU market: the Article 69 transitional rules

If you manufacture, import or distribute connected hardware in the EU, the most consequential CRA question for your existing portfolio is not the December 2027 deadline itself — it is what happens to the units you already shipped before that deadline. The answer sits almost entirely in Article 69 of Regulation (EU) 2024/2847 — the transitional provisions article. Read alongside the Article 3 definitions, Article 69 sets a default grandfather rule, a single carve-back for reporting, and a six-month transitional window for legacy notified body certificates. This guide walks through each paragraph with the verbatim text.

For the cut-over dates themselves see our CRA timeline and reporting obligations and CRA December 2027 readiness guides. For the Article 14 process that the carve-back imposes, see the ENISA 24-hour reporting guide.

Why Article 69 matters more than most CRA articles

Most CRA commentary focuses on the future-state obligations: Annex I essential requirements, the Article 13 manufacturer duties, the Article 14 reporting process, conformity assessment under Modules A through H. Article 69 instead answers the messy operational question every manufacturer with an existing EU footprint has to face: "what about the 50 000 units already in retail channels, the firmware-update fleet of 200 000 devices in the field, and the EU type-examination certificate I just paid for under the RED?"

The article runs to three paragraphs. Each one answers a distinct question. Each one is short. None of them have been amended since the OJEU publication on 20 November 2024.

Article 69(1) — existing notified body certificates

The verbatim text of Article 69(1):

"EU type-examination certificates and approval decisions issued regarding cybersecurity requirements for products with digital elements that are subject to Union harmonisation legislation other than this Regulation shall remain valid until 11 June 2028, unless they expire before that date, or unless otherwise specified in such other Union harmonisation legislation, in which case they shall remain valid as referred to in that legislation."

Three implications.

First, scope of paragraph 1 is narrow. It covers EU type-examination certificates and approval decisions — Module B / Module B+C / Module H outputs from notified bodies under the RED, the Machinery Directive, the EMC Directive, the Low Voltage Directive and any other Union harmonisation legislation with a cybersecurity cybersecurity component. It does NOT cover internal-control Module A self-declarations, which are not "issued" by a third party.

Second, 11 June 2028 is subject to the expiry and other-legislation conditions in Article 69(1). That date sits exactly six months after CRA main product-obligation application (11 December 2027). Article 69(1) preserves the validity of the specified certificates and approval decisions, unless they expire earlier or other legislation provides otherwise. This does not establish that a RED certificate covers every CRA requirement; assess the certificate scope and the remaining CRA obligations separately.

Third, the certificate's own expiry can shorten the window. If your RED Module B certificate is dated to expire on 1 March 2028, that earlier date wins. And if the underlying Union harmonisation legislation specifies a different sunset for cybersecurity certificates ("unless otherwise specified in such other Union harmonisation legislation"), that legislation wins.

A manufacturer relying on an existing certificate must document what it covers and what additional CRA evidence or assessment is necessary. Do not treat an EN 18031 certificate as automatic CRA conformity.

Article 69(2) — the grandfather rule for legacy products

The verbatim text of Article 69(2):

"Products with digital elements that have been placed on the market before 11 December 2027 shall be subject to the requirements set out in this Regulation only if, from that date, those products are subject to a substantial modification."

Two terms-of-art here. Both are defined in Article 3 of the Regulation.

"Placed on the market"

Article 3(21) defines placing on the market as "the first making available of a product with digital elements on the Union market". The corresponding Article 3(22) defines making available on the market as "the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge".

The phrase that matters is first making available. It is the manufacturer's first commercial supply of a specific unit into the EU. After that, a distributor selling that already-placed unit to the next economic operator is "making it available" but not "placing it on the market" again — the Union-law clock started ticking the moment the manufacturer first supplied it.

Practical consequence: if you ship 50 000 units to your EU distributor on 1 October 2027, every one of those 50 000 units is "placed on the market" before 11 December 2027, even though most of them will sit in retail warehouses and be sold to end-users in 2028. The grandfather rule attaches to each unit at the moment of the manufacturer's first supply, not at the moment of retail sale.

"Substantial modification"

Article 3, point 30 defines substantial modification as:

"a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I or which results in a modification to the intended purpose for which the product with digital elements has been assessed."

The test has two prongs, joined by OR. A change is substantial if EITHER it affects Annex I Part I compliance OR it modifies the intended purpose. The first prong is technical (cryptography swap, removed authentication, expanded attack surface). The second prong is functional (the product is now used for a purpose it was not previously assessed for — e.g. a sensor previously assessed as a local-only device now uploads to a cloud).

Routine bug-fix updates and security patches that do not alter the trust model are NOT substantial modifications. A patch that closes a CVE without changing the cybersecurity posture is exactly the kind of routine maintenance the CRA expects manufacturers to do — and it does not trigger full CRA conformity.

Operational effect

If you (a) shipped the unit before 11 December 2027 and (b) it has not been substantially modified since, the CRA Annex I essential requirements, the Article 13 manufacturer obligations and the conformity assessment requirements do not apply to that unit. You can keep selling pre-2027 inventory through normal distribution channels until it runs out.

The day you push a substantial modification — whether on day one of 2028 or in 2030 — the modified product steps fully into CRA scope. That includes Annex I Part I product requirements, Annex I Part II vulnerability handling (SBOM, security update process, public disclosure), conformity assessment under the right Module, the Declaration of Conformity citing Regulation (EU) 2024/2847, and technical documentation under Annex VII supporting the CRA Annex I requirements.

Article 69(3) — the Article 14 carve-back

The verbatim text of Article 69(3):

"By way of derogation from paragraph 2 of this Article, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027."

This is the single paragraph that catches most legacy fleets — and it catches them earlier than December 2027.

Article 14 sets the 24-hour notification duty for actively exploited vulnerabilities and severe incidents. Article 71(2) sets the Article 14 application date as 11 September 2026 — fifteen months earlier than the rest of the Regulation. Article 69(3) closes the loop: even legacy products grandfathered out of Annex I and Article 13 must still comply with Article 14 reporting, from 11 September 2026.

The practical implications:

• A device first sold in 2022 is still subject to Article 14 reporting in 2026.
• A device first sold in 2026 (before CRA general application) is still subject to Article 14 reporting from 11 September 2026.
• A device first sold in 2027 before 11 December is still subject to Article 14 reporting — Article 69(2) grandfathers it from Annex I obligations, but Article 69(3) keeps it inside Article 14.
• A device shipped in 2028 is in full CRA scope (no grandfathering applies).

For most fleets this means the 24-hour reporting process must be fleet-wide from day one, not "new products only". See the September 2026 reporting checklist for the operational walk-through.

How Article 69 interacts with the rest of the Regulation

Common mistakes

• Treating the grandfather rule as automatic. Article 69(2) only protects you if you can prove the unit was placed on the market before 11 December 2027 AND has not been substantially modified. Without shipping records and a documented modification log, the burden of proof flips against you in a market surveillance enquiry.
• Missing the Article 14 carve-back. Manufacturers reading only Article 69(2) see "grandfathering" and assume legacy fleets are fully out of CRA scope. Article 69(3) deletes that assumption for reporting. Build the Article 14 process fleet-wide.
• Confusing "placed on the market" with "sold to end-user". Article 3(21) anchors the test to first manufacturer supply, not retail sale. A unit shipped to an EU distributor in October 2027 and sold to an end-user in March 2028 is a pre-CRA unit, not a CRA-scoped unit.
• Assuming routine security patches trigger substantial modification. They generally do not. The Article 3(30) test is about Annex I Part I compliance or intended purpose, not about every code change. Build a documented "substantial modification" decision flow with engineering and legal sign-off so you can defend each release.
• Forgetting that Article 69(1) certificates expire on 11 June 2028, not 11 December 2027. Some compliance plans wrongly assume the RED-era certificate sunsets at CRA general application. It does not — you have six extra months.
• Treating the carve-out in Article 2 as a CRA escape. Carve-outs in Article 2 (medical devices under MDR/IVDR, type-approved motor vehicle systems, aviation, marine) remove the product from CRA scope entirely. They are not "transitional" — they are permanent. Don't confuse them with Article 69(2) grandfathering.

A per-SKU roadmap that maps to Article 69

For each SKU on your EU portfolio, decide three things before December 2027:

1. Last placing-on-market date. When do you stop shipping new units into the EU? After that date, every unit must be either (a) sold from existing pre-2027 stock or (b) shipped under full CRA conformity.
2. Modification posture. Will the product receive substantial modifications post-2027? If yes, plan for full CRA conformity from the first modified release. If no, plan for an end-of-life trajectory with only security maintenance.
3. Article 14 readiness. For every SKU still in the field on 11 September 2026 — including those you stopped shipping years ago — implement the Article 14 reporting process. This is the operational lift that most plans underestimate.

Cenitia assists with a limited EU regulatory catalogue, evidence-linked drafts and recorded human review. Its watcher detects changes in validated supported source pages and prompts review. It does not automatically ingest national legislation, all OJ standard editions or clause-level changes, certify conformity, or reissue signed declarations.

Using Cenitia for this work

Cenitia helps prepare evidence-linked working drafts within its supported regulatory catalogue. Confirm the product scope, actual applied standards and completed assessments, and review the result before issuance. Source-change alerts prompt a review; they do not certify conformity, automatically reissue a signed declaration or guarantee monitoring of every national rule and standard edition.

Related from the Library

• CRA timeline and reporting obligations
• CRA December 2027 readiness
• CRA September 2026 reporting checklist
• CRA ENISA 24-hour reporting
• CRA Annex I explained
• Updating a Declaration of Conformity after an amendment

Further reading

• Regulation (EU) 2024/2847 — Cyber Resilience Act, EUR-Lex
• CRA Article 69 — Transitional provisions
• CRA Article 71 — Entry into force and application
• CRA Article 14 — Reporting obligations of manufacturers
• CRA Article 3 — Definitions
• European Commission — Cyber Resilience Act policy page