EU Cyber Resilience Act deadlines and compliance calendar

Article 71 sets the main legal calendar. Entry into force is separate from application: the regulation entered into force on 10 December 2024, but the full CRA regime applies from 11 December 2027.

Two provisions apply earlier. Chapter IV applies from 11 June 2026 and Article 14 applies from 11 September 2026. Those dates have different audiences and should not be collapsed into one generic compliance deadline.

Chapter IV is titled notification of conformity assessment bodies. Its provisions are directed mainly at Member States, notifying authorities, and notified bodies, for example the duty for Member States to notify the Commission and other Member States and to designate a notifying authority.

For a manufacturer, 11 June 2026 is still commercially important if a product may need third-party assessment, but it is not the general date when CRA product obligations begin to apply.

Article 14 is the earlier operational date for manufacturers. From 11 September 2026, manufacturers must notify actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements through the single reporting platform.

The reporting clock for an actively exploited vulnerability or severe incident starts when the manufacturer becomes aware of it after Article 14 starts to apply. The Commission FAQ, updated 2 July 2026, says earlier awareness does not create a retroactive notification duty merely because 11 September 2026 arrives. The CRA sets separate stages for early warnings, follow-up notifications, final reports, and user information.

Article 69 prevents the transition period from being read too broadly. Products with digital elements placed on the market before 11 December 2027 are subject to CRA requirements only if, from that date, they undergo a substantial modification.

That transitional rule does not remove the earlier reporting duty. Article 69 expressly says Article 14 applies to all in-scope products with digital elements that were placed on the market before 11 December 2027. Placement on the market is assessed for each individual product, so earlier sales of the same model do not exempt units first placed on the market on or after 11 December 2027.

From 11 December 2027, the CRA applies generally. Products with digital elements placed on the EU market from that date need the applicable essential cybersecurity requirements, conformity assessment, technical documentation, EU declaration of conformity, CE marking, and economic-operator controls.

The product calendar should therefore work backward from the market-placement date. There is no extra post-application grace period for an individual product first placed on the market on or after 11 December 2027. Evidence needed for conformity should be produced during design, development, testing, vulnerability handling, release, and support rather than assembled after launch.

The CRA calendar continues after market placement. The regulation ties documentation retention to at least 10 years after placing the product on the market or the support period, whichever is longer, and it includes later review dates for certificates, the reporting platform, and the regulation itself.

These dates are not all manufacturer launch deadlines, but they matter for audit calendars, certification reliance, and regulatory monitoring.