---
title: "EU Cyber Resilience Act Scope, Duties and CE Marking"
canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act"
source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act"
author: "Sorena AI"
description: "Cyber Resilience Act hub for products with digital elements: scope, manufacturer/importer/distributor duties, vulnerability handling, reporting, conformity assessment and CE marking."
published_at: "2026-03-04"
updated_at: "2026-05-25"
keywords:
  - "EU Cyber Resilience Act scope"
  - "products with digital elements"
  - "CRA manufacturer obligations"
  - "CRA vulnerability handling"
  - "CRA Article 14 reporting"
  - "CRA CE marking"
  - "CRA conformity assessment"
  - "Cyber Resilience Act"
  - "Regulation (EU) 2024/2847"
  - "Vulnerability handling"
  - "Conformity assessment"
  - "CE marking"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# EU Cyber Resilience Act Scope, Duties and CE Marking

Cyber Resilience Act hub for products with digital elements: scope, manufacturer/importer/distributor duties, vulnerability handling, reporting, conformity assessment and CE marking.

![Cyber Resilience Act artifact preview](https://cdn.sorena.io/cdn-cgi/image/format=auto/cheatsheets/prod/sorena-ai-cra-timeline-small.jpg?v=cheatsheets%2Fprod)

*Cyber Resilience Act* *Free Resource*

## Cyber Resilience Act Scope, duties and CE marking

This hub helps decide whether a product is a product with digital elements under the CRA (Regulation (EU) 2024/2847), then map the duties that apply before it is placed on the EU market.

Practical guidance to plan with; validate your product scope, cybersecurity and vulnerability-handling duties, and conformity route against the Regulation and your own legal requirements.

[Review CRA readiness](/contact.md)

## What the hub helps you check

- **Product scope**: Check whether the item is a software or hardware product, a separately placed component, or a remote data processing solution needed for the product to function.
- **Economic-operator duties**: Separate manufacturer duties from importer and distributor checks, including CE marking, EU declaration of conformity, user instructions, support-period disclosure, and corrective-action triggers.
- **Security and evidence path**: Tie Annex I security properties, vulnerability handling, SBOM, coordinated disclosure, security-update delivery, Article 14 reporting, technical documentation, and conformity assessment to the same product model.

By Sorena AI | Updated 2026 | Based on official sources

### Quick scan

*CRA*

- **Start with the product boundary**: The CRA is about products with digital elements, including software, hardware, separately marketed components, and remote processing that the product needs for its functions.
- **Build the product security file**: Keep the risk assessment, Annex I requirement mapping, vulnerability-handling process, SBOM record, support-period rationale, user instructions, tests, and conformity evidence together.
- **Route CE and reporting work early**: Article 14 reporting applies before the main application date; conformity assessment and CE marking depend on whether the product is not important or critical, important class I, important class II, or critical.

Use the timeline and topic guides to move from product classification to release gates, security-update operations, reporting readiness, and market-surveillance evidence.

| Value | Metric |
| --- | --- |
| Annex I | Security |
| Art. 14 | Reporting |
| Art. 32 | Conformity |
| CE | Marking |

**Key highlights:** Classify product | Map duties | Prepare evidence

## Primary sources

- [Regulation (EU) 2024/2847](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847&ref=sorena.io) - Primary legal text for CRA scope, definitions, economic-operator obligations, Annex I cybersecurity requirements, Article 14 reporting, technical documentation, conformity assessment, CE marking, enforcement and staged application dates.
  - Quote: "products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity"
- [European Commission Cyber Resilience Act policy page](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act?ref=sorena.io) - Official Commission overview supporting the hub's framing of the CRA as mandatory cybersecurity requirements for software and hardware products with digital elements, lifecycle vulnerability handling, CE marking and market-surveillance enforcement.
  - Quote: "The CRA introduces mandatory cybersecurity requirements for manufacturers"
- [European Commission CRA technical FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission services' implementation FAQ supporting practical interpretation of products with digital elements, remote data processing, transition cases, support periods, Article 14 reporting, conformity assessment modules and CE marking.
  - Quote: "A product with digital elements also includes its remote data processing solutions."
- [European Commission draft guidance consultation](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) - Supports the page's caution that practical interpretation is being developed through Commission guidance, including scope, remote data processing, open-source software, support periods and interplay with other EU legislation.
  - Quote: "The guidance will help manufacturers, developers, and other stakeholders understand their obligations"
- [European Commission news on draft CRA guidance](https://digital-strategy.ec.europa.eu/en/news/commission-publishes-feedback-draft-guidance-assist-companies-applying-cyber-resilience-act?ref=sorena.io) - Supports the hub's focus on the implementation issues highlighted by the Commission's draft guidance: remote data processing, free and open-source software, support periods and interaction with other EU laws.
  - Quote: "focuses on remote data processing solutions and free and open-source software"

## Topic Guides

- [CRA Applicability Test for Products With Digital Elements](/artifacts/eu/cyber-resilience-act/applicability-test.md): Check whether the EU Cyber Resilience Act applies to a hardware, software, firmware, open-source, or connected product before conformity planning.
- [CRA Article 14 Reporting Obligations for Vulnerabilities and Incidents](/artifacts/eu/cyber-resilience-act/reporting-obligations.md): Article 14 guide to CRA reports for actively exploited vulnerabilities and severe product-security incidents, including deadlines, CSIRT routing, users, and evidence.
- [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md): CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions.
- [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md): Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence.
- [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md): Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records.
- [CRA Conformity Assessment and CE Marking](/artifacts/eu/cyber-resilience-act/conformity-assessment-and-ce-marking.md): How to choose a Cyber Resilience Act conformity route, prepare technical documentation, issue the EU declaration of conformity, and affix CE marking.
- [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md): Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route.
- [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md): CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence.
- [CRA deadlines and compliance calendar | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/deadlines-and-compliance-calendar.md): Track the Cyber Resilience Act entry into force, staged application dates, Article 14 reporting deadlines, transitional rules, and review dates.
- [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md): FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties.
- [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md): CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls.
- [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md): CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information.
- [CRA Essential Cybersecurity Requirements in Annex I](/artifacts/eu/cyber-resilience-act/essential-cybersecurity-requirements.md): An official source guide to the Cyber Resilience Act Annex I requirements for product security, vulnerability handling, secure-by-design controls, documentation, and evidence.
- [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md): FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes.
- [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md): Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence.
- [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md): FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences.
- [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md): Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility.
- [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md): Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates.
- [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md): FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence.
- [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md): Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records.
- [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md): FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls.
- [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md): Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties.
- [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md): CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes.
- [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md): CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records.
- [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md): Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work.
- [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md): Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations.
- [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md): Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths.
- [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md): FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs.
- [CRA Penalties and Fines: Article 64 Caps and Enforcement Context](/artifacts/eu/cyber-resilience-act/penalties-and-fines.md): Article 64 of the EU Cyber Resilience Act sets administrative fine ceilings for Annex I, manufacturer, reporting, economic-operator, notified-body, and information-request breaches.
- [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md): CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment.
- [CRA Products with Digital Elements Scope | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/products-with-digital-elements-scope.md): Apply the EU Cyber Resilience Act scope test for software, hardware, remote data processing, components, open-source software, exclusions, and economic-operator roles.
- [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md): EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries.
- [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md): FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information.
- [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md): Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence.
- [CRA Requirements | Annex I, Manufacturer Duties and CE Evidence](/artifacts/eu/cyber-resilience-act/requirements.md): Map Cyber Resilience Act requirements from Annex I to manufacturer duties, vulnerability handling, user information, technical documentation, declaration of conformity, and CE marking evidence.
- [CRA SBOM and Vulnerability Management Template](/artifacts/eu/cyber-resilience-act/sbom-and-vulnerability-management-template.md): Build a CRA-ready SBOM and vulnerability handling record with component inventory, triage, remediation, disclosure, reporting, update, and technical documentation fields.
- [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md): Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products.
- [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md): Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review.
- [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md): Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties.
- [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md): Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence.
- [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md): FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document.
- [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md): CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access.
- [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md): CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions.
- [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md): FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits.
- [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md): Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information.
- [CRA vs RED Cybersecurity Delegated Act](/artifacts/eu/cyber-resilience-act/cra-vs-red-cybersecurity-delegated-act.md): Compare the EU Cyber Resilience Act with the RED cybersecurity delegated act for connected and radio equipment, including scope, timing, evidence, and transition treatment.
- [CRA vs UK PSTI Act | Cyber Resilience Act Comparison](/artifacts/eu/cyber-resilience-act/cra-vs-uk-psti-act.md): Compare cited EU Cyber Resilience Act duties with UK PSTI planning points, with UK legal details clearly marked for separate source review.
- [CRA Vulnerability Handling and Disclosure | Article 14 Reporting and Security Updates](/artifacts/eu/cyber-resilience-act/vulnerability-handling-and-disclosure.md): How EU Cyber Resilience Act manufacturers should run vulnerability intake, remediation, coordinated disclosure, Article 14 reporting, secure updates, and evidence records.
- [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md): Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices.
- [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md): FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires.
- [EU CRA Compliance Program for Manufacturers and Economic Operators](/artifacts/eu/cyber-resilience-act/compliance.md): Build a Cyber Resilience Act compliance program around product scope, Annex I security requirements, conformity assessment, technical documentation, vulnerability reporting, and market surveillance.
- [EU Cyber Resilience Act Checklist for Product Security and CE Marking](/artifacts/eu/cyber-resilience-act/checklist.md): A CRA checklist for products with digital elements: scope, Annex I security controls, vulnerability handling, Article 14 reporting, technical documentation, conformity assessment, CE marking, and support-period evidence.
- [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md): CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification.
- [EU Cyber Resilience Act FAQ](/artifacts/eu/cyber-resilience-act/faq.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance.
- [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md): CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes.
- [EU Cyber Resilience Act Technical Documentation and Audit File](/artifacts/eu/cyber-resilience-act/technical-documentation-and-audit-file.md): Build an audit-ready CRA technical file around Article 31 and Annex VII: product scope, risk assessment, vulnerability handling, conformity evidence, testing, and retention.

## Key dates for Cyber Resilience Act implementation

*CRA Timeline*

Track the staged application of Chapter IV notified-body rules from 11 June 2026, Article 14 reporting from 11 September 2026, the main CRA obligations from 11 December 2027, and the related transition rules for products already placed on the market.

*Next step*

## Turn CRA product scope into owned security and conformity work

This hub is the shared entry point for CRA product classification, vulnerability-handling design, reporting readiness, technical documentation, conformity assessment, CE marking, and importer or distributor checks.

- Start with one product model, software release, component, or remote processing dependency and record the intended purpose, foreseeable use, EU market path, and economic-operator role.
- Use Assessment Autopilot to request the cybersecurity risk assessment, Annex I mapping, SBOM record, support-period rationale, coordinated disclosure policy, update-delivery evidence, tests, and EU declaration of conformity.
- Use Research Copilot for cited questions about product scope, remote data processing, open-source components, important or critical product classification, Article 14 reporting, and conformity assessment modules.
- Keep legal interpretation, engineering evidence, supplier records, release approvals, user information, vulnerability reports, and reassessment triggers connected to the same product file.

- [Open Assessment Autopilot](/solutions/assessment.md): Turn CRA scope, security requirements, vulnerability handling, reporting, conformity and CE evidence into owned tasks and review checkpoints.
- [Open Research Copilot](/solutions/research-copilot.md): Answer CRA scope, role, timing, reporting and interpretation questions with cited outputs from official sources.
- **Download CRA timeline**: Align staged application dates with product, engineering, legal, support, importer and distributor work.
- [Talk through implementation](/contact.md): Review your current product file, vulnerability-handling process, reporting readiness and conformity evidence model.

## Compliance Timeline

| Date | Event | Category | Reference |
| --- | --- | --- | --- |
| 2021-09-15 | CRA announced in State of the Union | Legislative History | [SOTEU 2021](https://commission.europa.eu/strategy-and-policy/state-union/state-union-2021_en?ref=sorena.io) |
| 2021-09-16 | Commission explainer on the CRA (quotes SOTEU speech) | Legislative History | [Source](https://commissioners.ec.europa.eu/how-european-cy-resilience-act-will-help-protect-europe-2021-09-16_en?ref=sorena.io) |
| 2022-03-16 | CRA public consultation | Legislative History | [Source](https://digital-strategy.ec.europa.eu/en/news/commission-invites-citizens-and-organisations-share-their-views-european-cyber-resilience-act?ref=sorena.io) |
| 2022-09-15 | CRA Commission proposal published | Legislative History | [COM(2022) 454](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52022PC0454&ref=sorena.io#:~:text=Brussels%2C%2015.9.2022%20COM(2022)454%20final) |
| 2023-06-08 | CRA Council general approach | Legislative History | [Source](https://www.consilium.europa.eu/en/policies/cybersecurity/timeline-cybersecurity/?ref=sorena.io#:~:text=The%20general%20approach%20on%20this%20proposal%20was%20reached%20on%208%20June) |
| 2023-07-19 | CRA Council common position | Legislative History | [Source](https://www.consilium.europa.eu/en/press/press-releases/2023/07/19/cyber-resilience-act-member-states-agree-common-position-on-security-requirements-for-digital-products/?ref=sorena.io) |
| 2023-07-19 | EP ITRE Committee adopts report | Legislative History | [Source](https://www.europarl.europa.eu/legislative-train/carriage/european-cyber-resilience-act/report?sid=7801&ref=sorena.io) |
| 2023-09-01 | Parliament enters interinstitutional negotiations | Legislative History | [Source](https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-european-cyber-resilience-act?ref=sorena.io#:~:text=Parliament%20confirmed%20committee%20decision%20to%20enter%20into%20interinstitutional%20negotiations%20in%20September%202023) |
| 2023-11-30 | CRA political agreement reached | Legislative History | [Source](https://www.consilium.europa.eu/en/press/press-releases/2023/11/30/cyber-resilience-act-council-and-parliament-strike-a-deal-on-security-requirements-for-digital-products/?ref=sorena.io) |
| 2023-12-01 | Parliament press release on political agreement | Legislative History | [Source](https://www.europarl.europa.eu/news/en/press-room/20231106IPR09007/cyber-resilience-act-agreement-with-council-to-boost-digital-products-security?ref=sorena.io) |
| 2024-03-12 | Parliament plenary adoption | Legislative History | [P9_TA(2024)0130](https://www.europarl.europa.eu/news/en/press-room/20240308IPR18991/cyber-resilience-act-meps-adopt-plans-to-boost-security-of-digital-products?ref=sorena.io) |
| 2024-10-10 | CRA Council formal adoption | Legislative History | [Source](https://www.consilium.europa.eu/en/press/press-releases/2024/10/10/cyber-resilience-act-council-adopts-new-law-on-security-requirements-for-digital-products/?ref=sorena.io) |
| 2024-10-23 | EU Cyber Resilience Act date | Official Publication | [Reg. (EU) 2024/2847](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847&ref=sorena.io) |
| 2024-11-20 | CRA published in Official Journal | Official Publication | [OJ L 2024/2847](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847&ref=sorena.io) |
| 2024-12-05 | Corrigendum: editorial title fix | Corrigendum | [Source](https://eur-lex.europa.eu/eli/reg/2024/2847/corrigendum/2024-12-05/oj/eng?ref=sorena.io#:~:text=On%20page%201%2C%20in%20the%20title%3A%20for%3A%20%E2%80%98Regulation%20(EU)%202024/2847) |
| 2024-12-10 | CRA entry into force | Applicability | [Art. 71(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847&ref=sorena.io#:~:text=This%20Regulation%20shall%20enter%20into%20force%20on%20the%20twentieth%20day) |
| 2024-12-10 | Delegated powers conferred (5-year period begins) | Delegated & Implementing Acts | [Art. 61(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847&ref=sorena.io#:~:text=shall%20be%20conferred%20on%20the%20Commission%20for%20a%20period%20of%20five%20years%20from%2010%20December%202024) |
| 2025-02-03 | Standardisation request M/606 adopted | Standardisation | [C(2025) 618](https://digital-strategy.ec.europa.eu/en/policies/cra-standardisation?ref=sorena.io#:~:text=has%20adopted%20a%20standardisation%20request%20M/606) |
| 2025-04-03 | M/606 officially accepted by CEN-CENELEC | Standardisation | [M/606](https://www.cencenelec.eu/news-events/news/2025/newsletter/ots-62-cra/?ref=sorena.io#:~:text=On%203%20April%2C%20the%20Standardization%20Request%20for%20the%20Cyber%20Resilience%20Act%20(CRA)%20was%20officially%20accepted) |
| 2025-07-02 | Corrigendum: Art. 64(10) cross-reference | Corrigendum | [Art. 64(10)](https://eur-lex.europa.eu/eli/reg/2024/2847/corrigendum/2025-07-02/oj/eng?ref=sorena.io#:~:text=By%20way%20of%20derogation%20from%20paragraphs%202%20to%209) |
| 2025-07-29 | Delegated Reg. 2025/1535 adopted | Delegated & Implementing Acts | [Reg. (EU) 2025/1535](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202501535&ref=sorena.io#:~:text=COMMISSION%20DELEGATED%20REGULATION%20(EU)%202025/1535) |
| 2025-10-03 | Corrigendum: Annex I language fix | Corrigendum | [Annex I](https://eur-lex.europa.eu/eli/reg/2024/2847/corrigendum/2025-10-03/oj/eng?ref=sorena.io#:~:text=annexe%20I%2C%20partie%20I%2C%20paragraphe%202)%2C%20point%20c) |
| 2025-10-17 | Corrigendum: Art. 67 numbering | Corrigendum | [Art. 67](https://eur-lex.europa.eu/eli/reg/2024/2847/corrigendum/2025-10-17/oj/eng?ref=sorena.io#:~:text=On%20page%2066%2C%20in%20Article%2067) |
| 2025-10-29 | Delegated Reg. 2025/1535 published in OJ | Delegated & Implementing Acts | [OJ L 2025/1535](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202501535&ref=sorena.io) |
| 2025-11-18 | Delegated Reg. 2025/1535 enters into force | Delegated & Implementing Acts | [Reg. (EU) 2025/1535](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202501535&ref=sorena.io) |
| 2025-11-28 | Implementing Reg. 2025/2392 adopted | Delegated & Implementing Acts | [Reg. (EU) 2025/2392](https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj/eng?ref=sorena.io) |
| 2025-12-01 | Implementing Reg. 2025/2392 published in OJ | Delegated & Implementing Acts | [OJ L 2025/2392](https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj/eng?ref=sorena.io) |
| 2025-12-11 | Delegated act on CSIRT notification delays | Delegated & Implementing Acts | [Art. 16(2)](https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation?ref=sorena.io#:~:text=11%20December%202025%20%20%20Delegated%20act%20on%20CSIRTs%20withholding%20notifications) |
| 2025-12-11 | Delegated act record published on EUR-Lex | Delegated & Implementing Acts | [C(2025) 8407](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=PI_COM%3AC(2025)8407&ref=sorena.io) |
| 2025-12-21 | Implementing Reg. 2025/2392 enters into force | Delegated & Implementing Acts | [Reg. (EU) 2025/2392](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202502392&ref=sorena.io#:~:text=This%20Regulation%20shall%20enter%20into%20force%20on%20the%20twentieth%20day) |
| 2026-03-03 | Draft CRA guidance published for feedback | Commission Deliverables | [Source](https://digital-strategy.ec.europa.eu/en/news/commission-publishes-feedback-draft-guidance-assist-companies-applying-cyber-resilience-act?ref=sorena.io) |
| 2026-03-31 | Feedback closes on draft CRA guidance | Commission Deliverables | [Source](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en?ref=sorena.io) |
| 2026-06-11 | Chapter IV applies: notified bodies | Conformity Assessment | [Art. 35-51](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847&ref=sorena.io#:~:text=However%2C%20Article%2014%20shall%20apply%20from%2011%20September%202026%20and%20Chapter%20IV%20(Articles%2035%20to%2051)%20shall%20apply%20from%2011%20June%202026) |
| 2026-06-11 | Notified bodies listed on NANDO/SMCS (as they are designated) | Conformity Assessment | [Source](https://digital-strategy.ec.europa.eu/en/policies/cra-conformity-assessment?ref=sorena.io#:~:text=Once%20a%20conformity%20assessment%20body%20has%20become%20a%20notified%20body%20it%20will%20be%20published%20on%20the%20NANDO%20website) |
| 2026-09-11 | Vulnerability reporting obligations apply | Vulnerability Reporting | [Art. 14](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847&ref=sorena.io#:~:text=Article%2014%20shall%20apply%20from%2011%20September%202026) |
| 2026-09-11 | CRA reporting deadlines (24h / 72h / 14d / 1 month) | Vulnerability Reporting | [Source](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting?ref=sorena.io) |
| 2026-09-11 | Open-source software stewards: reporting obligations apply (conditional) | Vulnerability Reporting | [Art. 24(3), Art. 14](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847&ref=sorena.io#:~:text=The%20obligations%20laid%20down%20in%20Article%2014(1)%20shall%20apply%20to%20open%2Dsource%20software%20stewards) |
| 2026-09-11 | Single Reporting Platform operational by this date | Commission Deliverables | [Source](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting?ref=sorena.io#:~:text=The%20Single%20Reporting%20Platform%20will%20be%20operational%20by%2011%20September%202026) |
| 2027-12-11 | CRA applies in full | Applicability | [Art. 71(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847&ref=sorena.io#:~:text=This%20Regulation%20shall%20apply%20from%2011%20December%202027) |
| 2027-12-11 | Legacy products: substantial modification rule | Applicability | [Source](https://digital-strategy.ec.europa.eu/en/policies/cra-summary?ref=sorena.io) |
| 2027-12-11 | Economic operators obligations apply (importers, distributors, authorised representatives) | Applicability | [Arts. 18-21](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847&ref=sorena.io#:~:text=Article%2019) |
| 2027-12-11 | Open-source software stewards: Article 24 obligations apply | Applicability | [Art. 24(1)-(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847&ref=sorena.io#:~:text=Open%2Dsource%20software%20stewards%20shall%20put%20in%20place%20and%20document%20in%20a%20verifiable%20manner) |
| 2029-12-10 | End of initial 5-year delegation period (unless extended) | Delegated & Implementing Acts | [Art. 61(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847&ref=sorena.io#:~:text=shall%20be%20conferred%20on%20the%20Commission%20for%20a%20period%20of%20five%20years%20from%2010%20December%202024) |

**Event details:**

- **2021-09-15 - CRA announced in State of the Union**: President von der Leyen announces the CRA in the State of the Union address: 'including legislation on common standards under a new European Cyber Resilience Act.'
- **2021-09-16 - Commission explainer on the CRA (quotes SOTEU speech)**: Commission explainer page published the day after SOTEU highlights the CRA and quotes the speech's CRA passage.
- **2022-03-16 - CRA public consultation**: Commission launches CRA public consultation, open 16 March to 25 May 2022.
- **2022-09-15 - CRA Commission proposal published**: Commission presents the CRA proposal COM(2022) 454 final.
- **2023-06-08 - CRA Council general approach**: Council reaches its 'general approach' (negotiating mandate) on the CRA at the JHA Council meeting.
- **2023-07-19 - CRA Council common position**: Member States agree a common position on security requirements for digital products.
- **2023-07-19 - EP ITRE Committee adopts report**: EP ITRE Committee adopts its report/position on the CRA.
- **2023-09-01 - Parliament enters interinstitutional negotiations**: Parliament confirms its committee decision to enter interinstitutional (trilogue) negotiations in September 2023.
- **2023-11-30 - CRA political agreement reached**: Council and Parliament reach provisional political agreement on the CRA.
- **2023-12-01 - Parliament press release on political agreement**: European Parliament press release on the agreement reached with the Council to boost digital products security.
- **2024-03-12 - Parliament plenary adoption**: European Parliament adopts the CRA in plenary: 517 in favour, 12 against, 78 abstentions.
- **2024-10-10 - CRA Council formal adoption**: Council formally adopts the Cyber Resilience Act.
- **2024-10-23 - EU Cyber Resilience Act date**: Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 (Cyber Resilience Act) is signed.
- **2024-11-20 - CRA published in Official Journal**: CRA published in the Official Journal of the European Union (OJ L 2024/2847, 20.11.2024).
- **2024-12-05 - Corrigendum: editorial title fix**: First corrigendum: corrects '(EU) No 2019/1020' to '(EU) 2019/1020' in the regulation title.
- **2024-12-10 - CRA entry into force**: CRA enters into force on the 20th day following OJ publication (20 Nov + 20 days = 10 Dec 2024).
- **2024-12-10 - Delegated powers conferred (5-year period begins)**: Delegation of power to the Commission is conferred for a period of five years from 10 December 2024, with tacit extensions unless opposed.
- **2025-02-03 - Standardisation request M/606 adopted**: Commission adopts CRA standardisation request M/606 containing 41 standards. Accepted by CEN, CENELEC, and ETSI on 3 April 2025.
- **2025-04-03 - M/606 officially accepted by CEN-CENELEC**: CEN-CENELEC officially accepted the CRA standardisation request on 3 April 2025.
- **2025-07-02 - Corrigendum: Art. 64(10) cross-reference**: Corrigendum fixes Article 64(10): 'paragraphs 3 to 9' corrected to 'paragraphs 2 to 9'.
- **2025-07-29 - Delegated Reg. 2025/1535 adopted**: Commission excludes most L-category vehicle products from CRA scope (exception for L1e pedal-designed). OJ publication 29 Oct 2025; enters into force 20 days later.
- **2025-10-03 - Corrigendum: Annex I language fix**: Corrigendum fixes FR/HU language wording in Annex I, Part I, paragraph 2, point (c).
- **2025-10-17 - Corrigendum: Art. 67 numbering**: Corrigendum fixes numbering reference in Article 67: '69' corrected to '72'.
- **2025-10-29 - Delegated Reg. 2025/1535 published in OJ**: Delegated Regulation (EU) 2025/1535 is published in the Official Journal on 29 October 2025.
- **2025-11-18 - Delegated Reg. 2025/1535 enters into force**: Delegated Regulation (EU) 2025/1535 enters into force on the twentieth day following its OJ publication.
- **2025-11-28 - Implementing Reg. 2025/2392 adopted**: Commission adopts technical descriptions for Annex III/IV product categories (important and critical products). OJ publication 1 Dec 2025; enters into force 20 days later.
- **2025-12-01 - Implementing Reg. 2025/2392 published in OJ**: Implementing Regulation (EU) 2025/2392 is published in the Official Journal on 1 December 2025.
- **2025-12-11 - Delegated act on CSIRT notification delays**: Commission adopts delegated act specifying terms and conditions for delaying dissemination of vulnerability notifications by CSIRTs under Article 16(2).
- **2025-12-11 - Delegated act record published on EUR-Lex**: EUR-Lex record for the Commission delegated act concerning Article 16(2) conditions for CSIRTs delaying dissemination to other CSIRTs.
- **2025-12-21 - Implementing Reg. 2025/2392 enters into force**: Implementing Regulation (EU) 2025/2392 enters into force on the twentieth day following its OJ publication.
- **2026-03-03 - Draft CRA guidance published for feedback**: Commission publishes draft CRA guidance for stakeholder feedback, clarifying scope, remote data processing, free and open-source software, support periods, and interplay with other EU law.
- **2026-03-31 - Feedback closes on draft CRA guidance**: The stakeholder feedback period on the Commission's draft CRA guidance closes on 31 March 2026.
- **2026-06-11 - Chapter IV applies: notified bodies**: CRA Chapter IV (Articles 35-51) on notification of conformity assessment bodies begins to apply.
- **2026-06-11 - Notified bodies listed on NANDO/SMCS (as they are designated)**: From the Chapter IV applicability date, conformity assessment bodies can be notified under the CRA framework and, once notified, will appear in the Commission's NANDO/SMCS notified bodies list for the CRA.
- **2026-09-11 - Vulnerability reporting obligations apply**: Article 14 (vulnerability and incident reporting) applies. Manufacturers must report actively exploited vulnerabilities and severe incidents via ENISA's Single Reporting Platform.
- **2026-09-11 - CRA reporting deadlines (24h / 72h / 14d / 1 month)**: From the Article 14 applicability date, incident/vulnerability notifications follow operational time limits (early warning within 24 hours of awareness; full notification within 72 hours; final report timelines depending on case, such as 14 days or 1 month).
- **2026-09-11 - Open-source software stewards: reporting obligations apply (conditional)**: Open-source software stewards are subject to Article 14(1) (and, where applicable, Article 14(3) and (8)) to the extent they are involved in development, from the date Article 14 applies.
- **2026-09-11 - Single Reporting Platform operational by this date**: Commission states ENISA's Single Reporting Platform (SRP) will be operational by 11 September 2026 to support CRA vulnerability and incident reporting.
- **2027-12-11 - CRA applies in full**: General application date: the CRA applies in full from 11 December 2027.
- **2027-12-11 - Legacy products: substantial modification rule**: Products placed on the EU market before 11 December 2027 are subject to CRA product requirements only if, from that date, they undergo a substantial modification; reporting obligations still apply from the earlier reporting applicability date.
- **2027-12-11 - Economic operators obligations apply (importers, distributors, authorised representatives)**: From the general CRA application date, authorised representatives, importers, and distributors must comply with their CRA obligations; in certain cases (e.g., own-branding or substantial modification) importers/distributors are treated as manufacturers.
- **2027-12-11 - Open-source software stewards: Article 24 obligations apply**: Open-source software stewards must have a verifiable cybersecurity policy for secure development and vulnerability handling, and cooperate with market surveillance authorities (subject to CRA scope).
- **2029-12-10 - End of initial 5-year delegation period (unless extended)**: The initial five-year period for the Commission's delegated powers runs until 10 December 2029, subject to tacit extensions unless opposed.


---

[Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act