CRA Compliance
Timeline
Three key milestones define the CRA compliance journey. The most urgent - and the one most organisations are unprepared for - is September 2026.
11 Sep 2026
Reporting obligations - legacy trap
11 Dec 2026
Notified bodies in place
11 Dec 2027
Full compliance + CE marking
Full Compliance Timeline
From publication to full enforcement - what each milestone requires in practice.
CRA Published in the Official Journal
EU Regulation 2024/2847 published in the Official Journal of the European Union. The regulation identifier and full text became officially available via EUR-Lex.
Required actions
- Regulation text officially published
- 20-day period before entry into force began
- Manufacturers should begin gap assessment against Annex I requirements
CRA Enters Into Force
The Cyber Resilience Act became legally binding on 11 December 2024. The 21-month transitional period for reporting obligations and 36-month transitional period for full compliance began from this date.
Required actions
- Regulation legally binding across all EU member states
- Member states must begin implementing national enforcement measures
- 21-month clock to reporting obligations started (→ Sep 2026)
- 36-month clock to full compliance started (→ Dec 2027)
Vulnerability Reporting Obligations Active
The most urgent CRA deadline. Manufacturers must begin reporting actively exploited vulnerabilities and severe incidents via the ENISA-operated EU single reporting platform. Applies to all products currently on the market - including legacy products.
Required actions
- 24-hour early warning obligation active for actively exploited vulnerabilities
- 72-hour intermediate notification requirement active
- 14-day final report requirement active
- Applies to ALL products on market - not just new products launched after this date
- Coordinated vulnerability disclosure (CVD) policy must be in place
- ENISA single reporting platform must be configured and tested
Member States Must Have Notified Bodies in Place
EU member states must have designated and notified their conformity assessment bodies (notified bodies) to the European Commission by this date. These are the organisations authorised to assess Class II products.
Required actions
- National notified bodies must be designated by each member state
- Notified body assessments for Class II products can proceed
- Manufacturers of Class II products should engage notified bodies early - capacity may be limited
- Class I products: third-party assessment or harmonised standard compliance must be achievable
Full CRA Compliance Required
All products with digital elements placed on the EU market after this date must be fully CRA compliant. Products already on the market continue to be subject to reporting obligations. This is the deadline for security-by-design, CE marking, and complete lifecycle management.
Required actions
- Conformity assessment completed for product category (self / third-party / notified body)
- CE marking affixed to all products with digital elements on EU market
- EU Declaration of Conformity prepared and retained for 10 years
- Technical documentation complete and available to market surveillance authorities
- SBOM in machine-readable format maintained and updated
- Security update policy covering minimum 5-year support in place
- End-of-support notification process established
Transitional Arrangements
The CRA includes limited transitional provisions for products already on the market. Understanding these is critical - they do not provide the broad exemption many manufacturers assume.
What transitional arrangements cover
Products placed on the EU market before 11 December 2027 that comply with existing applicable law may continue to be made available until that date without meeting full CRA conformity assessment requirements (CE marking, technical documentation, Annex I security-by-design).
What transitional arrangements do NOT cover
Transitional arrangements do not extend to the September 2026 reporting obligations. From 11 September 2026, the following apply to all products currently on the market - regardless of when they were first placed:
- - Active vulnerability monitoring and exploitation detection
- - 24-hour early warning reporting to ENISA
- - 72-hour intermediate notification
- - 14-day final report obligation
- - Coordinated vulnerability disclosure policy
Benchmark your CRA readiness
A free 5-minute self-assessment across governance, vulnerability handling, incident response, recovery and supply chain, with a scored report and practical next steps.
Check Your CRA Readiness