Deadlines

CRA timeline: what applies when

Reviewed August 2026 against Regulation (EU) 2024/2847, OJ L, 12.12.2024.

Most coverage of the Cyber Resilience Act stops at "everything applies in December 2027." That's wrong in a dangerous way: two major regimes are already in force, and one of them puts reporting duties on manufacturers this September.

11 June 2026: the notified-body framework is live

Chapter IV of the CRA is about notification of conformity assessment bodies, not enforcement: Member States designate notifying authorities, and assessment bodies can be listed to handle Class II and Annex IV conformity checks. It imposes no duty on manufacturers yet; its relevance is practical. If your product will need a notified body in December 2027, the queues you will join are being formed now.

“Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.” (Article 71, entry into force and application, CELEX 32024R2847)

11 September 2026: reporting duties begin

From this date, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA/CSIRTs:

24 hours: early warning after becoming aware of an actively exploited vulnerability or severe incident;
72 hours: vulnerability notification;
one month: final report after the incident notification.

If your product reaches customers, ask today: who receives the vulnerability report, at what address, and can they turn it into an ENISA filing within a day? If the answer is "we'd figure it out," you now know what to build before September.

11 December 2027: full application

The main event: technical documentation, SBOM covering top-level dependencies, a declared support period of at least five years (or the expected use time where the product is expected to be in use for less than five years), conformity assessment, and CE marking become mandatory for in-scope products placed on the EU market. Conformity work takes months: for Annex III Class II and Annex IV products it requires a notified body, and notified-body queues are exactly the kind of thing you don't discover in October 2027.

What to do with these dates

Determine whether your product is in scope at all; the free check takes minutes.
If in scope, stand up the Art. 14 reporting pipeline before 11 September 2026.
Start conformity work now if your route involves a notified body.

Not sure which dates bind you? Run the free Cybiq check: six questions, a definitive verdict, and every claim anchored word-for-word in the Official Journal.

Orientation, not legal advice. Verify against the official text before relying on any item.