The CRA skips the vehicle. It does not skip everything around it.
Type-approved vehicles and their components are excluded from the CRA. Chargers, backends, aftermarket telematics and diagnostic tools are not. Many automotive suppliers make both.
QuickTARA covers both in one tool: ISO/SAE 21434 and UN R155 for the vehicle side, the CRA for the rest.
Is the product a vehicle, or a system, component or separate technical unit type-approved under Regulation (EU) 2019/2144?
This covers ECUs supplied into a type-approved vehicle. Medical devices, civil aviation and marine equipment have similar exclusions.
- EV charging equipment and charge point backends
- Aftermarket telematics units and dongles
- Diagnostic tools and workshop equipment
- Backends that serve as remote data processing for a connected product
- Vehicles type-approved under Regulation (EU) 2019/2144
- Systems, components and separate technical units approved under it
- Medical devices, civil aviation and marine equipment under their own rules
Reporting already applies.
- 10 Dec 2024
Regulation (EU) 2024/2847 enters into force.
- 11 Jun 2026
Rules for conformity assessment bodies apply.
- 11 Sep 2026
Article 14 reporting applies: actively exploited vulnerabilities and severe incidents, for products already on the market too.
- 11 Dec 2027
All other obligations apply, including Annex I essential requirements and conformity assessment.
The CRA work, next to the TARA it depends on.
The same architecture, threats and controls feed both the vehicle evidence and the CRA file.
Book a technical demo- Article 14 reporting clocks: 24-hour early warning, 72-hour notification and the final report.
- Export of the notification content for the ENISA single reporting platform.
- Annex I Part I security requirements mapped to your TARA controls.
- Annex I Part II vulnerability handling, fed by SBOM matching against OSV, NVD and CISA KEV.
- Annex VII technical documentation and Annex II user information.
- The conformity assessment steps for your product class.