EU Cyber Resilience Act deadlines and compliance calendar

Article 71 sets the main legal calendar. Entry into force is separate from application: the regulation entered into force on 10 December 2024, but the full CRA regime applies from 11 December 2027.

Two provisions apply earlier. Chapter IV applies from 11 June 2026 and Article 14 applies from 11 September 2026. Those dates have different audiences and should not be collapsed into one generic compliance deadline.

Chapter IV is titled notification of conformity assessment bodies. Its provisions are directed mainly at Member States, notifying authorities, and notified bodies, for example the duty for Member States to notify the Commission and other Member States and to designate a notifying authority.

For a manufacturer, 11 June 2026 is still commercially important if a product may need third-party assessment, but it is not the general date when CRA product obligations begin to apply.

Article 14 is the earlier operational date for manufacturers. From 11 September 2026, manufacturers must notify actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements through the single reporting platform.

The reporting clock starts when the manufacturer becomes aware of the relevant vulnerability or incident. The CRA sets separate stages for early warnings, follow-up notifications, final reports, and user information.

Article 69 prevents the transition period from being read too broadly. Products with digital elements placed on the market before 11 December 2027 are subject to CRA requirements only if, from that date, they undergo a substantial modification.

That transitional rule does not remove the earlier reporting duty. Article 69 expressly says Article 14 applies to all in-scope products with digital elements that were placed on the market before 11 December 2027.

From 11 December 2027, the CRA applies generally. Products with digital elements placed on the EU market from that date need the applicable essential cybersecurity requirements, conformity assessment, technical documentation, EU declaration of conformity, CE marking, and economic-operator controls.

The product calendar should therefore work backward from the market-placement date. Evidence needed for conformity should be produced during design, development, testing, vulnerability handling, release, and support rather than assembled after launch.

The CRA calendar continues after market placement. The regulation ties documentation retention to at least 10 years after placing the product on the market or the support period, whichever is longer, and it includes later review dates for certificates, the reporting platform, and the regulation itself.

These dates are not all manufacturer launch deadlines, but they matter for audit calendars, certification reliance, and regulatory monitoring.