Find the exact question, open the source answer card, and copy a direct link to the anchored sub-FAQ response.
The CRA entered into force on 10 December 2024.
The Regulation itself says it enters into force on the twentieth day following its publication in the Official Journal. The Commission FAQ uses the concrete date 10 December 2024.
Article 71(1)
Sections 7.1 and 7.2 state the CRA entered into force on 10 December 2024 and generally applies from 11 December 2027.
The CRA generally applies from 11 December 2027.
But the Regulation also has two earlier phased dates:
- Chapter IV, covering the notification of conformity assessment bodies, applies from 11 June 2026
- Article 14 reporting obligations apply from 11 September 2026
Article 71(2) sets the general application date and the two earlier application dates for Article 14 and Chapter IV.
Chapter IV of the CRA starts to apply on 11 June 2026. That chapter covers notifying authorities and conformity assessment bodies, including designation, notification, operation, and oversight of notified bodies.
The Commission FAQ explains that Member States must have their notifying-authority arrangements in place by that date.
Article 71(2), Articles 35-51
Section 7.1 confirms the Chapter IV start date and explains the notifying-authority setup timing.
Article 14 starts to apply on 11 September 2026. From that date, manufacturers must report actively exploited vulnerabilities and severe incidents having an impact on the security of their products through the CRA reporting system.
Article 24(3) contains separate reporting duties for open-source software stewards and refers to Article 14, but Article 71(2) does not make Article 24 applicable early. Those steward duties apply from 11 December 2027.
Article 71(2) applies Article 14 from 11 September 2026 but does not give Article 24 an earlier application date.
Section 7.1 confirms Article 14 applies earlier than the Regulation's general application date.
The CRA generally applies from 11 December 2027.
From 11 December 2027, the manufacturer obligations, essential cybersecurity requirements, conformity assessment rules, CE marking framework, market surveillance rules, and the rest of the CRA apply, except for the earlier-starting provisions that already applied before that date.
Article 71(2)
Section 7.1 explains that the CRA applies from 11 December 2027, with Article 14 and Chapter IV applying earlier.
Yes.
The CRA turns on placement on the market of the individual product, not on the date the project started. The Commission FAQ makes this explicit by explaining that individual products first placed on the market on or after 11 December 2027 must comply, even if the product type or earlier units existed before then.
Article 71(2), Article 69(2)
Section 7.2 applies the transition rule by individual product placement on the market.
Section 2.3 explains that placing on the market happens once for each individual product, not for a product type.
Yes, subject to any other applicable Union legislation.
The CRA's main product-compliance obligations do not apply until 11 December 2027. The transition problem is not whether the product must already bear CRA CE evidence before that date, but how the manufacturer prepares so that products first placed on the market on or after that date will comply.
Article 71(2) means the CRA's main product-compliance obligations generally apply from 11 December 2027.
Yes.
The Commission FAQ says this directly. During the Transition Period, manufacturers may integrate third-party components that do not yet bear CRA CE marking, because those component manufacturers may not yet be under the CRA's full application date. The integrating manufacturer should still exercise due diligence through other means so the component does not compromise the cybersecurity of the finished product.
Section 7.3 addresses integration of components that do not yet bear CRA CE marking during the transition period.
Article 13(5), recital 35
No.
Article 13(5) is part of the manufacturer obligations that apply from 11 December 2027, but the Commission FAQ's transition guidance is clear about the practical point: manufacturers preparing products for post-application placement should expect to exercise due diligence even where CRA CE marking is not yet available on integrated components.
Article 13(5), recital 35
Section 7.3 says the integrating manufacturer still needs other due-diligence measures where CRA CE marking is unavailable.
Yes.
The Commission FAQ says manufacturers are free to integrate components, including important or critical products with digital elements, even where those components were not designed in accordance with harmonised standards. Harmonised standards are a route to presumption of conformity, not a mandatory condition for integration.
That point matters during the transition because the absence of harmonised standards, or the fact that a component does not follow them, does not by itself block integration. The manufacturer still has to assess and manage the resulting risks.
Article 27(1), Article 13(5)
Section 7.4 addresses important or critical components that do not follow harmonised standards during the transition period.
Article 69(1) says those certificates and approval decisions remain valid until 11 June 2028, unless they expire earlier or the other Union legislation says otherwise.
The March 2026 draft guidance explains that this can include certificates or approval decisions issued under legislation such as the RED cybersecurity delegated act or the Machinery Regulation, but only for the cybersecurity risks actually covered by those instruments.
Article 69(1)
Section 7.1 references the Article 69 transitional rule for existing cybersecurity certificates and approvals.
Points 223 and 228-231 explain that earlier certificates can be used only for the cybersecurity risks they actually cover.
No.
The March 2026 draft guidance says those certificates or approval decisions remain relevant only for the cybersecurity risks they actually cover. Manufacturers still have to assess and address any remaining CRA-relevant risks that fall outside the scope of the earlier certificate.
Article 69(1), Article 13(2)
Points 228-232 explain why RED or Machinery certificates do not by themselves prove full CRA compliance.
Commission Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 with effect from 11 December 2027. That means the timing of placing on the market matters:
- products placed on the market between 1 August 2025 and 10 December 2027 can remain subject to the RED cybersecurity essential requirements made applicable by that delegated regulation
- products first placed on the market on 11 December 2027 or later are subject to the CRA cybersecurity requirements instead of the repealed RED cybersecurity requirements
The repeal does not affect Union market surveillance and control under the RED for radio equipment placed on the market during the earlier RED window.
Repeals Delegated Regulation (EU) 2022/30 from 11 December 2027 and preserves RED market surveillance and control for radio equipment placed on the market from 1 August 2025 to 10 December 2027.
No, unless the product is substantially modified from that date.
Article 69(2) preserves the pre-existing status of products already placed on the market, while Article 69(3) separately keeps Article 14 reporting obligations applicable.
Article 69(2) limits full CRA application for pre-11 December 2027 products unless substantially modified; Article 69(3) preserves Article 14 reporting.
Yes.
This is the specific consequence of the phased dates. Article 14 starts on 11 September 2026, and Article 69(3) extends it to in-scope products already placed on the market before 11 December 2027.
Article 69(3) extends Article 14 to in-scope products already placed on the market before 11 December 2027, and Article 71(2) sets the Article 14 start date.
Section 5.3 answers reporting for products placed on the market before the CRA generally applies.