Cyber Resilience Act Timeline & Current Status — October 2026
Where the EU Cyber Resilience Act stands right now: which obligations already apply, which deadline comes next, and what manufacturers should do about it.
Quick Answer
As of October 2026, the Cyber Resilience Act (Regulation (EU) 2024/2847) is in force and two of its milestones already apply. The notified-body provisions have applied since 11 June 2026. The Article 14 reporting obligation has applied since 11 September 2026: manufacturers report actively exploited vulnerabilities and severe incidents to the coordinating CSIRT and ENISA, also for products already on the market. The next deadline is full application on 11 December 2027.
Updated on October 7, 2026: the Article 14 EU CRA reporting obligation has applied since 11 September 2026. Until this update, the quick answer, timeline and FAQ still described it as an upcoming deadline.
Is the Cyber Resilience Act Already in Force?
Yes. The Cyber Resilience Act entered into force on 10 December 2024 and applies directly in all EU member states, without national implementation laws. Since 11 September 2026 the Article 14 reporting obligations apply to every manufacturer; the remaining product requirements follow on 11 December 2027.
EU CRA Timeline: Which Deadlines Apply — and Which Comes Next?
The regulation fixes four milestones. Here is where they stand as of October 2026:
| Date | Milestone | Status |
|---|---|---|
| 10 December 2024 | EU CRA enters into force — transition period starts for all manufacturers | In effect |
| 11 June 2026 | Notified-body provisions apply (Chapter IV) — conformity assessment bodies can be notified | In effect |
| 11 September 2026 | Article 14 reporting obligations: actively exploited vulnerabilities and severe incidents are reported to the coordinating CSIRT and ENISA, with an early warning within 24 hours — including for products already on the market | In effect |
| 11 December 2027 | Full application: every new product with digital elements placed on the EU market must meet all EU CRA requirements | Next up |
What Should Manufacturers Do Now?
The Article 14 reporting obligation has applied since 11 September 2026. The priorities:
- 1
Run the reporting process, not just document it
The Article 14 reporting cascade to the coordinating CSIRT and ENISA covers products already on the market: early warning within 24 hours, an update within 72 hours, and a final report within 14 days for an actively exploited vulnerability or one month for a severe incident. That takes vulnerability monitoring, an assessment path and a submission workflow that are tested in practice.
- 2
Complete the product inventory and risk classification
Which products fall under the EU CRA, and into which Annex III class? The classification decides whether self-assessment is enough or a notified body must be involved — and notified-body capacity for the EU CRA is still building up.
- 3
Work backwards from 11 December 2027
An EU CRA compliance project typically takes 9–12 months. Products placed on the market from 11 December 2027 need the full evidence chain: risk assessment, SBOM, Annex VII documentation, declaration of conformity.
Frequently Asked Questions About the Current CRA Status
When does the Cyber Resilience Act apply?+
The Cyber Resilience Act has been in force since 10 December 2024, with obligations phasing in. The notified-body provisions have applied since 11 June 2026, the Article 14 reporting obligations since 11 September 2026, and full application for all new products on the EU market begins on 11 December 2027.
Is the Cyber Resilience Act already in force?+
Yes, since 10 December 2024. As an EU regulation, the Cyber Resilience Act applies directly in all member states without national implementation laws. The Article 14 reporting obligations have applied since 11 September 2026; the next binding deadline is full application on 11 December 2027.
What has applied since 11 September 2026?+
Since 11 September 2026, manufacturers report actively exploited vulnerabilities and severe incidents to the coordinating CSIRT and ENISA under Article 14 EU CRA: early warning within 24 hours, supplementary details within 72 hours, final report within 14 days (vulnerabilities) or one month (incidents). The obligation also covers products already on the market.
Does the CRA apply to products already on the market?+
The full product requirements apply to products placed on the EU market from 11 December 2027. The Article 14 reporting obligations, which have applied since 11 September 2026, also cover products already on the market — vulnerabilities in existing products must be monitored and reported.
Where can I read the official CRA text?+
The official text of Regulation (EU) 2024/2847 is published on EUR-Lex in all EU languages, including a PDF version from the Official Journal. Our knowledge base mirrors the full text — all articles, recitals and annexes — with plain-language explanations and FAQ.
How Ready Are You for the Next Deadline?
The free CRA maturity assessment shows you in about 15 minutes where your organization stands against the reporting obligations in force today and full application on 11 December 2027 — with a prioritized roadmap.