The Cyber Resilience Act timeline: all 9 dates from 2024 to 2030

When does the Cyber Resilience Act apply?

The Cyber Resilience Act has been in force since December 10 2024, applies in stages, and becomes fully applicable on December 11 2027. Between those two dates, some obligations have already come into force. After 2027, three review and transition dates follow.

The Cyber Resilience Act timeline at a glance

Nine dates shape the CRA timeline. Five have already passed, and four are still ahead.

Dates that have passed

Dates still ahead

Why the CRA applies in stages

The CRA deadlines switch on in the order businesses need them.

First come the bodies that will assess products, so capacity exists before anyone needs a certificate.

Next come the reporting duties, which give authorities the chance to react to incidents while businesses work on their security processes.

The full product obligations arrive last, giving manufacturers three years from entry into force to build security into their products.

December 10 2024: the CRA enters into force

On December 10 2024, the Cyber Resilience Act became EU law. It started the clock on every deadline that follows.

Entry into force versus application

Entry into force means the Regulation is legally binding and part of the EU legal order. It doesn't mean manufacturers had to do anything on that day. No essential requirements, reporting duties, or CE marking rules applied in December 2024. Article 71(2) defers each obligation to a later application date, which is why "the CRA is in force" and "the CRA applies to my product" are two different statements.

Adoption and publication

The European Parliament and the Council adopted the CRA on October 23 2024 as Regulation (EU) 2024/2847. It was published in the Official Journal of the European Union on November 20 2024. Under Article 71(1), it entered into force on the twentieth day after publication: December 10 2024. As a regulation, it applies directly in all 27 Member States, with no national transposition needed.

June 11 2026: rules for notified bodies

Since June 11 2026, Member States can designate and notify the bodies that will carry out third-party CRA conformity assessments. This is the first date that changes something in a practical sense for both authorities and businesses.

What Chapter IV covers

Chapter IV, Articles 35 to 51, sets out the notification procedure for conformity assessment bodies. It covers:

• The notifying authorities each Member State sets up
• The requirements a body must meet to become a notified body, including independence, competence, and liability insurance
• How a body applies, how it is notified to the Commission, and how the Commission can challenge that competence
• The operational duties of notified bodies and how they coordinate with each other

What notified body capacity means for your date

Notification only opened in June 2026, so the pool of CRA notified bodies is still forming. If your product needs third-party assessment, your December 2027 deadline depends on that capacity. That applies to critical products and important products in Class II, and to important products in Class I where harmonized standards are not applied in full.

Expect demand to bunch up in 2027. Check the European Commission's NANDO database for bodies notified under the CRA, and start conversations early.

September 11 2026: reporting obligations begin

Since September 11 2026, manufacturers must report actively exploited vulnerabilities and severe incidents under Article 14. This is the first CRA duty that applies directly to businesses, and it is already live.

Reporting an actively exploited vulnerability

When you become aware of an actively exploited vulnerability in your product, you submit three reports:

1. Early warning within 24 hours of becoming aware, without undue delay
2. Vulnerability notification within 72 hours of becoming aware. Include general information about the product, the general nature of the exploit and the vulnerability, any corrective or mitigating measures taken, and measures users can take. State how sensitive you consider the information to be
3. Final report no later than 14 days after a corrective or mitigating measure becomes available

Reporting a severe incident

A severe incident affecting the security of your product triggers a separate obligation that follows the same three steps:

1. Early warning within 24 hours of becoming aware, stating whether the incident is suspected of being caused by unlawful or malicious acts.
2. Incident notification within 72 hours of becoming aware, covering the nature of the incident, an initial assessment, and any corrective or mitigating measures.
3. Final report within one month of submitting the 72-hour notification. It describes the incident in detail, including its severity and impact, the type of threat or likely root cause, and the mitigation applied and ongoing.

Note the difference: the incident final report is due within one month, instead of 14 days.

When an incident counts as severe

Under Article 14(5), an incident is severe when it:

• Negatively affects, or could negatively affect, the product's ability to protect the availability, authenticity, integrity, or confidentiality of sensitive or important data or functions, or
• Has led, or could lead, to the introduction or execution of malicious code in the product or in the user's network and information systems

Who you report to and how

You report simultaneously to the Computer Security Incident Response Team (CSIRT) designated as coordinator in the Member State of your main EU establishment and to the EU Agency for Cybersecurity (ENISA), through the single reporting platform under Article 16. You submit once, and both recipients receive it.

The deadlines are not cumulative. The 24-hour and 72-hour clocks both run from the moment you become aware, so the 72-hour notification is due 72 hours after awareness, not 72 hours after the early warning.

CRA reporting is separate from NIS2 reporting. NIS2 is triggered by a significant incident affecting the services your organization provides, and you report to your national CSIRT or competent authority. The CRA is triggered by your product, and reports go through the single reporting platform. One event can trigger both responses, so map both processes side by side.

December 11 2027: full application

From December 11 2027, every product with digital elements placed on the EU market must comply with the CRA in full. Without compliance, there is no CE marking, and without CE marking, there is no EU market access.

What becomes mandatory

• The 21 essential requirements in Annex I: 13 product security requirements in Part I and 8 vulnerability handling requirements in Part II
• Conformity assessment through the procedure that matches your product's classification
• Technical documentation under Annex VII, covering design, risk assessment, and vulnerability handling
• The EU declaration of conformity, in which you take responsibility for compliance
• CE marking on the product, showing it meets the CRA

How much lead time this really needs

Work backwards from December 2027, and the window is shorter than it looks. Your conformity assessment has to finish before that date, and it needs complete evidence to assess. That evidence comes from security work built into your development process, not added at the end.

If your product needs a notified body, add the time it takes to secure a slot, complete the assessment, and fix any findings. For many teams, that means the work needs to be underway now.

What the timeline means for products already on the market

The Article 69 cut-off

Under Article 69(2), products placed on the market before December 11 2027 fall under the CRA only if they are substantially modified from that date. A product you placed on the market in 2026 and leave unchanged doesn't need CE marking under the CRA.

What counts as a substantial modification

Article 3(30) defines a substantial modification as a change that affects compliance with the essential requirements in Annex I Part I, or transforms the product's intended purpose. For example:

• Counts as a substantial modification: You add remote cloud access to an industrial controller that previously worked only on a closed local network. The attack surface changes, so the original security assessment no longer holds.
• Doesn't count as a substantial modification: You ship a security update that fixes a vulnerability without changing the product's functions or intended purpose. Patching keeps the product secure; it doesn't make it a new product.

The exception: reporting applies to all legacy products

Article 69(3) makes an exception. By derogation from Article 69(2), the Article 14 reporting obligations apply to all in-scope products placed on the market before December 11 2027.

What this means in practice: if a product you sold in 2022 has an actively exploited vulnerability today, you must send an early warning within 24 hours of becoming aware. No modification, CE marking, or new sale is needed to trigger that duty.

The Cyber Resilience Act timeline after 2027

Full application is not the end of the timeline. Three later dates matter for certification, reporting, and the future shape of the Regulation.

June 11 2028: legacy certificates expire

Under Article 69(1), EU-type examination certificates and approval decisions on cybersecurity requirements issued under other Union harmonization legislation stay valid until June 11 2028. That holds unless they expire earlier or the other legislation says otherwise.

This matters if you are already certified under the Radio Equipment Directive's cybersecurity requirements or under machinery law. Your existing certificate buys you six months beyond full application. Plan your CRA assessment so it is complete before that certificate lapses.

September 11 2028: Commission report on the reporting platform

By September 11 2028, the Commission needs to report to the European Parliament and the Council on how well the Article 16 single reporting platform works.

December 11 2030: first evaluation of the Regulation

By December 11 2030, the Commission needs to submit its first evaluation and review report under Article 70(1). Further reports would follow every four years, with each one made public. This is where the annexes, product categories, or deadlines could be changed.

What the CRA timeline means for UK manufacturers

If you sell products with digital elements into the EU, every date still applies to you.

Why these dates apply to you regardless of Brexit

The CRA binds anyone who places products with digital elements on the EU market, not only manufacturers established in the EU. A UK manufacturer selling a connected device in Germany has the same essential requirements, reporting duties, and the December 2027 deadline as a German one.

Under Article 18, you can appoint an EU authorized representative by written mandate to carry out specific tasks on your behalf. If you don't, your EU importers must verify your compliance before they place your products on the market. Either way, finding the right partner and agreeing on who does what takes months. Treat it as a lead-time item of its own.

How the CRA sits alongside UK cyber legislation

Status as of October 9 2026. The UK's Cyber Security and Resilience (Network and Information Systems) Bill updates the NIS Regulations 2018. It was introduced in the House of Commons on November 12 2025 and completed its Commons stages on June 16 2026. Lords committee stage began on September 1 2026, and Lords report stage is scheduled for October 26 2026. It is not yet law.

The two are separate regimes with separate scopes. The UK bill regulates organizations that run essential and digital services, such as energy, healthcare, data centers, and managed service providers. The CRA regulates products.

A UK company can fall under both: once as a service operator in the UK, and once as a manufacturer selling into the EU. On the product side, the UK's own rules sit in the Product Security and Telecommunications Infrastructure (PSTI) regime for consumer connectable products, which has applied since April 29 2024.

What a UK manufacturer should do first

1. Map your EU sales. List every product with digital elements you place on the EU market, and confirm which are in scope
2. Set up CRA reporting now. It has applied since September 11 2026, including for products you already sell. Align it with your UK incident processes so one event doesn't need two separate reactions
3. Decide on your EU representation. Appoint an authorized representative or agree on responsibilities with your importers
4. Build one evidence base for both regimes. Reuse risk assessments, security testing, and vulnerability handling records across the CRA, PSTI, and UK NIS work where the requirements overlap

What missing a CRA deadline costs

Missing a CRA deadline can cost you a fine of up to EUR 15 million. For most manufacturers, losing access to the EU market costs more.

Fines

Under Article 64(2), breaches of the essential requirements in Annex I and of the manufacturer obligations in Articles 13 and 14 carry fines of up to EUR 15 million or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher. Article 14 is the reporting obligation, so this ceiling already applies today.

The micro and small enterprise exception

Article 64(10) protects the smallest manufacturers on one point. Microenterprises and small enterprises face no administrative fine for missing the 24-hour early warning deadline specifically. The 72-hour notification and the final report are not covered by this exception.

Company size also counts beyond that. Under Article 64(5), authorities must take the size and market share of the operator into account when setting any fine, with particular regard to microenterprises and SMEs.

The bigger risk: market withdrawal

Market surveillance authorities can require you to bring a non-compliant product into compliance, withdraw it from the market, or recall it. For most manufacturers, a product pulled from the EU market costs more than the maximum fine. Lost revenue, recall logistics, and damaged customer trust add up fast, and they keep adding up until the product is compliant again.

From the Cyber Resilience Act timeline to your roadmap

Turn the timeline into a plan by starting at December 11 2027 and counting backwards. Build in buffers, because every step depends on the one before it.

Planning backwards from December 2027

These suggested milestones leave a three-month buffer before full application:

1. Product inventory, by end of 2026. List every product with digital elements you place on the EU market, including software and remote data processing solutions
2. Classification, by Q1 2027. Sort each product into default, important class I, important class II, or critical. This decides your conformity assessment route and whether you need a notified body
3. Gap analysis, by Q2 2027. Compare each product and your development process against the 21 essential requirements in Annex I. Book a notified body slot now if you need one
4. Conformity assessment, by Q3 2027. Run the self-assessment or third-party assessment, and close the findings
5. Evidence complete, by September 2027. Finish the Annex VII technical documentation and the EU declaration of conformity, ready for CE marking on December 11 2027

Checking the reporting process separately

Reporting has applied since September 11 2026, so it doesn't belong in your 2027 plan. Instead, it belongs on today's agenda. Check three things:

• Owner named: one person or team is accountable for each 24-hour, 72-hour, and final report
• Platform access set up: the people who submit reports can access the single reporting platform
• Process rehearsed at least once: you have run a tabletop exercise against the real deadlines

Who owns which date

How DataGuard helps your team plan for the CRA

Nine dates, two of them already live, and a deadline that needs work today: the CRA is a lot to keep track of. DataGuard helps you turn the timeline into a plan your whole team can follow.

Our platform helps you set up coordinated vulnerability handling, so your reporting process is ready for the 24-hour clock. You can build on the work you have already done for ISO 9001, ISO 27001, or NIS2, instead of starting from scratch.

Ready to get CRA-ready? Book a demo, and we'll walk you through it.