Cyber Resilience Act deadlines: what applies and when

The Cyber Resilience Act (CRA) switches on in three steps. The rules for conformity assessment bodies applied from 11 June 2026, the duty to report exploited vulnerabilities and severe incidents from 11 September 2026, and everything else from 11 December 2027 (Article 71(2)). So if you make connected devices, reporting already applies to you today, and you have just over a year to get the rest in place.

The dates in one table

Date	What happens	Source
20 November 2024	The CRA is published in the Official Journal as Regulation (EU) 2024/2847	EUR-Lex
10 December 2024	It enters into force, twenty days after publication	Article 71(1)
28 November 2025	The Commission adopts the technical descriptions of important and critical product categories	Implementing Regulation (EU) 2025/2392
11 June 2026	Chapter IV applies: rules for notifying conformity assessment bodies	Article 71(2)
11 September 2026	Reporting duties apply, through ENISA's Single Reporting Platform	Articles 14 and 71(2)
11 December 2027	All other duties apply, including Annex I, the technical file and the CE mark	Article 71(2)

"Enters into force" and "applies" mean different things. From December 2024 the law existed; it starts to bind you on the dates further down the table.

11 June 2026: outside auditors get ready

Chapter IV (Articles 35 to 51) sets the rules for the bodies that check products from outside, called notified bodies. It applied first so those bodies could be approved in time. For most small makers nothing changed on this date. It matters if your product falls into class II of Annex III or into Annex IV, because then you'll need one of these bodies before you sell. Our product classes guide explains which products those are.

11 September 2026: reporting is live

Since this date you must report two things through ENISA's Single Reporting Platform: actively exploited vulnerabilities in your product, and severe incidents that affect its security (Article 14). There is a 24-hour early warning, a 72-hour notification and a final report.

The platform launched in a basic version. It has no machine interface, so reports are typed in by a person at your company.

One detail catches people out. Reporting covers every product in scope that you have already placed on the market, not only new ones (Article 69(3)). A router you shipped in 2023 is covered today.

11 December 2027: everything else

From this date a new product needs the full set before it goes on sale:

• the essential requirements in Annex I, all 22 points;
• a risk assessment and a technical file (Article 31, Annex VII);
• a support period of at least five years, unless the product is expected to be in use for less (Article 13(8));
• a conformity assessment, a signed EU declaration of conformity and the CE mark.

Products already on the market

Products placed on the market before 11 December 2027 only have to meet the CRA requirements if you make a substantial modification to them from that date (Article 69(2)). The reporting duty is the exception, as above.

A substantial modification is a change after the product reached the market that affects how it meets the Annex I Part I requirements, or that changes its intended purpose (Article 3(30)). A firmware release that adds a remote access feature may count; a fix for a display glitch is unlikely to. The Commission has to publish guidance on this concept (Article 26(2)(d)), so watch for it before you decide.

What hasn't landed yet

Some pieces are still moving. When we last checked, on 31 October 2026:

• No harmonised CRA standard had been cited in the Official Journal. The EN 40000 series is in draft.
• The Commission hadn't set an SBOM format by implementing act, though it has the power to (Article 13(24)). ENISA published an SBOM technical advisory in October 2026.
• The Digital Omnibus proposal would create a single EU entry point for incident reporting built on the platform. It isn't adopted and it doesn't move any CRA date.

None of these change the dates above. Check the Commission's CRA implementation page for news.

A plan that fits a small team

Counting back from December 2027 gives you about 13 months. A sensible order:

1. Now: make sure someone can file a 24-hour early warning, and that you'd notice an exploited flaw in a part you use.
2. Early 2027: find out your product class, list what's inside each firmware, and start the risk assessment.
3. Mid 2027: write the technical file and the vulnerability handling policy; book a notified body if your class needs one.
4. Before December 2027: run the conformity assessment, sign the declaration, mark the product.

Booking an outside body is the step most likely to slip, because the rules for approving those bodies only applied from June 2026.

What Proofsheet does here

For the reporting duty that applies now, Watchdog (€79 a month, opening soon) is a software subscription. It re-scans every release you upload and sends you an email when a part you use shows up on CISA's known exploited list. Its 24-hour kit generates drafts of the early warning, the 72-hour notification, the final report and the user notice. You submit them on ENISA's platform; the app doesn't file anything.

For the December 2027 work, the app generates a parts list from one upload, matches exact versions to known CVEs and maps the evidence to the 22 Annex I points, in minutes. It's technical evidence, not a legal certificate.

See prices, or read the guides on reporting and manufacturer obligations.