The general grandfathering rule that exempts pre-December 2027 products from most EU Cyber Resilience Act requirements does not apply to Article 14's vulnerability and incident reporting obligations