Cyber Resilience Act Response Center Request a demoDemo

Guide Last updated 12 min read

The Cyber Resilience Act timeline: what applies when

The Cyber Resilience Act applies in stages. The most important stage is behind us: since 11 September 2026, the reporting obligation has applied, including to products that have been on the market for years. This page sets out every key date and explains what counts for legacy products and stock.

The Cyber Resilience Act (Regulation (EU) 2024/2847) has been in force since 10 December 2024 and applies in three stages. Since 11 June 2026, conformity assessment bodies can be notified. Since 11 September 2026, Article 14 has required every manufacturer to report actively exploited vulnerabilities and severe incidents, including for products shipped years ago. From 11 December 2027, everything else applies: product requirements, documentation, conformity assessment, CE marking, the obligations of importers and distributors, and the framework for administrative fines (Article 71(2)).

Key points

  • The reporting obligation under Article 14 has applied since 11 September 2026, including to legacy products (Article 69(3)).
  • All other obligations, including Annex I, CE marking and Article 64 (administrative fines), apply from 11 December 2027 (Article 71(2)).
  • Products placed on the market before 11 December 2027 are subject to the product requirements only if they undergo a substantial modification (Article 69(2)).
  • What counts is the date on which the individual unit or software version is first made available on the EU market, not the stock in the warehouse.
  • As of October 2026, harmonised standards and notified bodies are still missing; conformity has to be demonstrated even without standards.

What are the key dates?

The dates are set out in Article 71 (application), Article 69 (transitional provisions) and Article 70 (evaluation and review). In addition, there are deadlines for standards, which are not in the Regulation and may shift.

  1. 10 December 2024The Regulation enters into force on the twentieth day following its publication in the Official Journal on 20 November 2024 (Article 71(1)). No obligations for manufacturers arise on that day.
  2. 11 June 2026Chapter IV (Articles 35 to 51) applies: Member States may notify conformity assessment bodies for the CRA (Article 71(2)). The BSI launched its notification procedure on that day.
  3. 11 September 2026Article 14 applies: manufacturers report actively exploited vulnerabilities and severe incidents via ENISA's single reporting platform, which went live on that day. Legacy products are covered too (Article 69(3)).
  4. 31 October and 31 December 2026Deadlines for the first harmonised standards under the amended standardisation request M/606: horizontal core standards by 31 October 2026, vertical product standards by 31 December 2026 (Commission draft of July 2026, secondary source, formal adoption not confirmed). As of October 2026, no CRA standard has been published in the Official Journal.
  5. 11 December 2027Full application (Article 71(2)): Annex I, Article 13, technical documentation, conformity assessment, CE marking, support period, obligations of importers and distributors. Article 64, with its framework for administrative fines, also applies from that day. From then on, the reporting obligation also covers open-source software stewards under Article 24(3).
  6. 11 June 2028Until that day, EU type-examination certificates and approval decisions concerning cybersecurity requirements issued under other Union harmonisation legislation remain valid, unless they expire earlier (Article 69(1)).
  7. 11 September 2028The Commission submits its report on the effectiveness of the single reporting platform (Article 70(2)).
  8. 11 December 2030First overall evaluation of the Regulation, then every four years (Article 70(1)).

What applies today, and what from December 2027?

ObligationWhat applies todayWhat applies from 11 December 2027
Reporting actively exploited vulnerabilities and severe incidents (Article 14)Applies since 11 September 2026, to all products on the marketContinues to apply, additionally to open-source stewards
Informing users about vulnerabilities (Article 14(8))Applies since 11 September 2026Continues to apply
Product requirements (Annex I, Part I)Not yet mandatoryFor every unit and every version first placed on the market from that day
Vulnerability handling, SBOM, security updates (Annex I, Part II)Not yet mandatoryMandatory
Technical documentation, conformity assessment, EU declaration of conformity, CE marking (Article 13(12))Not yet mandatoryMandatory before placing on the market
Determining and stating the support period and its end date (Article 13(8) and (19))Not yet mandatoryMandatory
Obligations of importers and distributors (Articles 19 and 20)Not yet mandatoryMandatory
Administrative fines (Article 64)Not yet applicableUp to EUR 15 million or 2.5 per cent of total worldwide annual turnover, whichever is higher, for infringements of Annex I, Article 13 and Article 14

On administrative fines: some commentators claim that infringements of the reporting obligation have been subject to fines since 11 September 2026. However, Article 71(2) only exempts Article 14 and Chapter IV from the general date of application, 11 December 2027; Article 64 is part of the rest. The Commission takes the same view: according to the Commission services' FAQ, market surveillance and enforcement apply only from 11 December 2027 (question 7.1). Completed failures from the period before that date therefore cannot be fined retroactively (section 3 of the German Act on Regulatory Offences (OWiG) and Article 49(1) of the Charter of Fundamental Rights). It is open whether a notification that is never made counts as a continuing failure beyond that date (section 4(2) OWiG). The reporting deadlines apply regardless. More in the guide Fines and market surveillance under the CRA.

What applies to legacy products?

Legacy products are products placed on the market before 11 December 2027. A transitional rule applies to them, with one important exception.

Article 69(2) provides that products placed on the market before 11 December 2027 are subject to the requirements of the Regulation only if, from that date, they undergo a substantial modification.

As long as a legacy product is not substantially modified, the manufacturer therefore does not have to bring it into line with Annex I retroactively, draw up technical documentation, carry out a conformity assessment or affix a CE marking under the CRA. The guide Substantial modification explains what a substantial modification is.

The exception is in Article 69(3): the reporting obligation under Article 14 applies to all products within scope, including those placed on the market before 11 December 2027. A manufacturer that has been shipping a controller since 2019 has had to report since 11 September 2026 if a vulnerability in it is actively exploited. According to the Commission guidance C(2026) 5252 (paragraph 210), the reporting obligation also applies after the end of the support period; the Regulation does not, however, require vulnerability handling under Annex I, Part II for legacy products. If a manufacturer substantially modifies a legacy product after 11 December 2027, the requirements apply, according to the guidance (paragraph 124), to the modified part or, where the cybersecurity of the product as a whole is affected, to the entire product.

When is a product "placed on the market"?

Under Article 3, point (21), placing on the market means the first making available of a product on the EU market. How this is counted depends on the type of product.

Hardware: every unit counts

For hardware, the individual unit is decisive, not the product type; the Commission guidance expressly adopts this principle from the Blue Guide for the CRA (paragraph 11). A device that goes to the distributor in November 2027 is a legacy product. An identical device from production in January 2028 is new and must comply. The Commission services' FAQ works this through with routers: 10,000 units placed on the market before 11 December 2027 do not have to be retrofitted by the manufacturer; a further 5,000 identical units may only be placed on the market after that date if they comply (question 7.2). Goods in the warehouse of the manufacturer, its authorised representative or the importer have not yet been placed on the market (Blue Guide, section 2.3). Goods that passed to a distributor before the cut-off date may still be sold by that distributor afterwards without retrofitting (Blue Guide, section 2.10; Commission services' FAQ, question 7.5).

Software: every version counts

For software, according to the Commission guidance (paragraph 15 and example 2), the version counts. Version 1.0.0, first made available on 1 January 2028, is placed on the market on that day; later downloads of the same version are merely acts of making available. A software company that releases version 7.0 in October 2027 and version 7.1 with fixes in February 2028 has two legacy versions. Version 8.0 with a new cloud connection in March 2028, by contrast, would be a new placing on the market with all the obligations. Products developed before December 2027 and placed on the market only afterwards must comply; according to the guidance (paragraphs 33 and 34), no redesign is needed if an up-to-date risk assessment shows that the existing measures are adequate.

When will standards and notified bodies be available?

Two building blocks that the Regulation presupposes are still missing as of October 2026. That is no reason to wait, but it changes the route to conformity.

  • Harmonised standards. Under the draft amendment to standardisation request M/606 of July 2026, the horizontal core standards are due by 31 October 2026, the vertical product standards by 31 December 2026 and the remaining horizontal standards by 30 October 2027; the draft has not been formally adopted. According to secondary sources, EN 40000-1-1 and EN 40000-1-2 passed the formal vote in early October 2026. No CRA standard has been published in the Official Journal; without publication of the reference, there is no presumption of conformity under Article 27(1).
  • Notified bodies. No notified body for the CRA is listed in the EU's NANDO database (last confirmed check 8 September 2026). In Germany, the procedure combines accreditation by DAkkS, the national accreditation body, with notification by the BSI. Details in the guide Product classes and conformity assessment.
  • German implementation act. The German CRA implementation act (CRA-Durchführungsgesetz) has not been promulgated and has been with the Bundestag's Committee on Internal Affairs (Innenausschuss) since 11 June 2026; for the current status, see the guide The German CRA implementation act.

Common mistakes

  • "We are only affected from December 2027." The reporting obligation has applied since 11 September 2026, including to legacy products. A manufacturer that has no reporting address, no call chain and no access to the ENISA platform today is not meeting an obligation that already applies.
  • Counting stock as legacy products. Only units supplied to distributors or customers before 11 December 2027 are legacy products.
  • Waiting for harmonised standards. Conformity can be demonstrated without standards: Annex VII, point (5) then requires a description of the solutions adopted.

For the reporting obligation that has applied since September 2026, CRA Response Center provides the readiness: it monitors the reporting address, at night too, alerts the people responsible when important messages arrive and records awareness and deadlines in the history. The manufacturer submits the notification itself.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Since when has the CRA applied?

The Regulation has been in force since 10 December 2024. The reporting obligation under Article 14 has applied since 11 September 2026; all other obligations apply from 11 December 2027 (Article 71(2)).

Does the reporting obligation also apply to products that have been on the market for a long time?

Yes. Article 69(3) expressly excludes Article 14 from the transitional rule for legacy products. Every product within scope that is in use with customers in the EU today is covered by the reporting obligation.

Do I have to add a CE marking under the CRA to legacy products retroactively?

No, as long as they are not substantially modified after 11 December 2027 (Article 69(2)). A security update that reduces the risk and does not change the intended purpose is not a substantial modification.

What happens to my stock on 11 December 2027?

Units supplied to distributors or customers by then are legacy products. Units supplied for the first time after that date must comply, even if they were produced earlier.

What about certificates under the Radio Equipment Directive?

Certificates concerning cybersecurity requirements issued under other legal acts remain valid until 11 June 2028, unless they expire earlier (Article 69(1)). According to the guidance (secondary source), this only covers the risks assessed there.

When does the reporting obligation apply to open-source stewards?

From 11 December 2027. The later date follows from Article 24(3) in conjunction with Article 71(2) and has been confirmed by ENISA and the Commission.

Further reading

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days