Guide · updated 17 October 2026

Cyber Resilience Act timeline and deadlines

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) phases in over three years. One deadline has already passed: since 11 September 2026, manufacturers must report exploited vulnerabilities within 24 hours. Here's every date that matters and what it means for a product maker.

The key dates at a glance

Date	Milestone	What it means for you
15 Sep 2022	European Commission proposes the CRA	History.
30 Nov 2023	Parliament and Council reach political agreement	The final shape of the obligations is known.
20 Nov 2024	Published in the Official Journal	The legal text is final.
10 Dec 2024	Entry into force	The transition clock starts.
11 Jun 2026	Rules on notifying conformity assessment bodies apply (Chapter IV)	Notified bodies can be designated for important and critical products that need third-party assessment.
11 Sep 2026	Reporting obligations apply (Article 14)	In force now. Report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform: 24h / 72h / final report. Applies to products already on the market.
11 Dec 2027	Full application	Essential cybersecurity requirements, vulnerability handling (including SBOM and disclosure policy), conformity assessment and CE marking for products placed on the market from this date.

11 September 2026: reporting (now in force)

This is the date most small manufacturers missed. Since 11 September 2026, if you become aware of an actively exploited vulnerability in your product, or a severe incident affecting its security, you must:

send an early warning within 24 hours,
a notification within 72 hours,
and a final report within 14 days of a fix being available (one month after the notification, for incidents),

all through ENISA's Single Reporting Platform, and inform affected users. Crucially, this covers every product you've placed on the EU market, including those sold before the CRA existed. Details: CRA reporting requirements and how to file on the SRP.

11 December 2027: full application

From this date, products with digital elements placed on the EU market must meet the essential requirements in Annex I and carry CE marking based on a conformity assessment. That includes:

security by design and by default, based on a cybersecurity risk assessment;
no known exploitable vulnerabilities at release, secure default configuration, and security updates;
vulnerability handling: an SBOM, a coordinated vulnerability disclosure policy, a contact address for reports, free security updates and published advisories;
a defined support period, generally at least five years;
technical documentation and an EU declaration of conformity.

Most products can self-assess. "Important" products (Annex III) in class II, and "critical" products (Annex IV), need third-party assessment or certification, which is why notified bodies start being designated in 2026.

Products placed on the market before 11 December 2027 generally only fall under the full requirements if they are substantially modified afterwards. The reporting obligation is the exception: it already applies to them.

What changed since adoption

In November 2025 the Commission proposed a "digital omnibus" package that, among other things, creates a single entry point for incident reporting across EU laws, built on the CRA's Single Reporting Platform. It doesn't remove or postpone the CRA's reporting duty. We update this page when anything material changes.

Fines

Up to €15 million or 2.5% of worldwide annual turnover for breaching the essential requirements or the obligations in Articles 13 and 14; up to €10 million or 2% for other obligations; up to €5 million or 1% for supplying incorrect or misleading information to authorities.

What to do, by date

Now (reporting is live)	During 2027	Before 11 Dec 2027
Publish a security contact and disclosure policy. Set up a monitored inbox, a product and version register, a reporting runbook and ENISA platform access.	Run a cybersecurity risk assessment per product. Generate SBOMs in your builds. Decide support periods. Check whether any product is important or critical.	Complete technical documentation, conformity assessment and the EU declaration of conformity, then CE-mark new products.

Behind on the September 2026 deadline?

We get your reporting process in place within a week, then stay on call. Start with the free scanner to see where you stand.

See how it works

Sources: Regulation (EU) 2024/2847, Articles 14, 64, 69 and 71 and Annexes I, III, IV; COM(2025) 837. Not legal advice.