EU Cyber Resilience Act, CRA Product Security and CE Marking Deadlines and Compliance Calendar

The CRA entered into force on 10 December 2024. That did not mean every obligation applied immediately, but it started the implementation clock for manufacturers, authorities, and standards bodies.

The next two dates matter for operating capability and external assurance, and the final date matters for placing products on the market under the full regime.

On 3 March 2026, the Commission published draft CRA guidance for feedback. It is not yet final law, but it is the clearest current Commission statement on remote data processing, open source software, support periods, and the interaction between CRA duties and other Union product rules.

The feedback period runs until 31 March 2026. Teams should use this draft guidance to pressure-test product scoping, reporting ownership, and support-period rationale, while still anchoring final legal positions in the regulation itself until the guidance is formally adopted.

By the time the notified body framework is live, important and critical product teams should already know which product families may need external conformity assessment and what evidence will be expected.

This is also the stage to stabilise classification and technical documentation structures.

Article 14 is an operational milestone, not a legal note in a tracker. By this date you need reporting templates, routing, user communication workflows, and incident escalation that can distinguish an actively exploited vulnerability from a severe incident.

Remember that the CRA makes Article 14 applicable to all in scope products placed on the market before 11 December 2027 as well.

This is the full market entry date. Products placed on the market from this date need the full CRA stack, including Annex I controls, support period determination, user information, technical documentation, declaration of conformity, and CE marking.

The worst possible plan is to start building the technical file in late 2027. Most of the evidence should already be flowing from your normal release and support process.

The calendar does not stop at market entry. The support period can run for years, and the CRA keeps applying throughout that period. Product calendars should therefore include recurring reviews, update availability checks, component support reviews, and end of support communication milestones.

If your product remains in use for a long time, those recurring dates may create more work than the launch date itself.