Deadlines
CRA timeline: countdown to each date
Reviewed August 2026 against Regulation (EU) 2024/2847, OJ L, 12.12.2024.
The Cyber Resilience Act does not arrive all at once: it has three application dates, each switching on a different set of duties. This page counts down to each one and states what applies then, and to whom, using only verbatim quotes from the Official Journal text (CELEX 32024R2847). The countdowns run in your browser; the dates do not change.
11 June 2026: Chapter IV, notification of conformity assessment bodies
applies from 11 June 2026
Chapter IV (Articles 35 to 51) is in force since this date. It concerns the notification of conformity assessment bodies: Member States designate notifying authorities, and assessment bodies can be notified and listed to carry out third-party conformity assessments. It imposes no duty on manufacturers, importers or distributors yet. Its relevance is practical: if your product will need a notified body for 11 December 2027, the queues you will join are being formed now.
“This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.”
“NOTIFICATION OF CONFORMITY ASSESSMENT BODIES”
11 September 2026: Article 14, reporting obligations of manufacturers
applies from 11 September 2026
Article 14 applies from this date regardless of the December 2027 deadline, and it binds manufacturers only. From this date a manufacturer must report actively exploited vulnerabilities and severe incidents to ENISA and the CSIRTs via the single reporting platform: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report within one month after submitting the incident notification. Importers and distributors are not bound by Article 14; their own notification duties (inform the manufacturer; inform market surveillance authorities on significant cybersecurity risk) begin at full application, under Articles 19 and 20.
“Reporting obligations of manufacturers”
“without undue delay and in any event within 24 hours of the manufacturer becoming aware of it”
“within 72 hours”
“a final report, within one month after the submission of the incident notification under point (b)”
11 December 2027: full application
applies from 11 December 2027
All main obligations apply from this date: technical documentation, SBOM covering top-level dependencies, a declared support period of at least five years (or the expected use time where the product is expected to be in use for less than five years), conformity assessment, and CE marking become mandatory for in-scope products placed on the EU market. For manufacturers this is the CE marking deadline. For importers and distributors it is when their own duties bind: verification before placing on the market or making available, and the Articles 19 and 20 notification duties (inform the manufacturer of vulnerabilities without undue delay; immediately inform market surveillance authorities where a product presents a significant cybersecurity risk). Conformity work takes months, so start now if your route involves a notified body.
“This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.”
“the support period shall be at least five years”
“Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time.”
“visibly, legibly and indelibly indicate their conformity”
“Upon becoming aware of a vulnerability in the product with digital elements, importers shall inform the manufacturer without undue delay about that vulnerability”
“Upon becoming aware of a vulnerability in the product with digital elements, distributors shall inform the manufacturer without undue delay about that vulnerability”
What to do now
- Manufacturers: stand up the Article 14 reporting pipeline before 11 September 2026 (who receives the report, at what address, who files with ENISA), and start conformity work now if your route involves a notified body. Check your duties as a manufacturer.
- Importers: verify the products you bring onto the EU market, and prepare the Article 19 notification duties that start with full application on 11 December 2027. Check your duties as an importer.
- Distributors: confirm due-care verification before making products available, and prepare the Article 20 notification duties that start with full application on 11 December 2027. Check your duties as a distributor.
Orientation, not legal advice. Countdowns use UTC and your device's clock; the quoted dates come from the Official Journal text. Verify before relying on any item.