Deadlines

CRA timeline: what applies when

By HEXENKRAFT. Reviewed against the primary text in August 2026.

Most coverage of the Cyber Resilience Act stops at "everything applies in December 2027." That's wrong in a dangerous way: Article 71(2) brings two blocks forward. Chapter IV, the notified-body framework, has applied since 11 June 2026, and the Article 14 reporting duties have bound manufacturers since 11 September 2026. Market surveillance and everything else waits for 11 December 2027.

11 June 2026: the notified-body rules apply

Chapter IV of the CRA is about notification of conformity assessment bodies, not enforcement: Member States designate notifying authorities, and conformity assessment bodies can be notified to carry out third-party conformity assessment under Art. 32. It imposes no duty on manufacturers yet; its relevance is practical. If your product will need a notified body in December 2027, the queues you will join are being formed now.

“Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.” (Article 71, entry into force and application, CELEX 32024R2847)

11 September 2026: reporting duties begin

Since this date, manufacturers must report actively exploited vulnerabilities and severe incidents simultaneously to the CSIRT designated as coordinator and to ENISA, via the single reporting platform:

24 hours: early warning after becoming aware of an actively exploited vulnerability or severe incident;
72 hours: vulnerability or incident notification;
14 days or one month: final report, 14 days after a corrective or mitigating measure is available for a vulnerability, one month after the incident notification for a severe incident.

If your product reaches customers, ask today: who receives the vulnerability report, at what address, and can they turn it into an early warning to the CSIRT and ENISA within 24 hours? If the answer is "we'd figure it out," you now know what to build next.

11 December 2027: full application

The main event: technical documentation, an SBOM covering at least the top-level dependencies, a declared support period of at least five years (or the expected use time where the product is expected to be in use for less than five years), conformity assessment, and CE marking become mandatory for in-scope products placed on the EU market. Conformity work takes months: for Annex III Class II and Annex IV products it requires module B+C, module H or a European cybersecurity certification scheme (Art. 32(3) and (4)), and notified-body queues are exactly the kind of thing you don't discover in October 2027.

What to do with these dates

Determine whether your product is in scope at all; the free check takes minutes.
If in scope, stand up the Art. 14 reporting pipeline now; it has been required since 11 September 2026.
Start conformity work now if your route involves a notified body.

Not sure which dates bind you? Run the free Cybiq check: five or six questions, a cited verdict, and every claim anchored word-for-word in the Official Journal.

Orientation, not legal advice. Verify against the official text before relying on any item.