Cyber Resilience Act timeline: what you must have ready and when

By Kike Gandia · Co-Founder & CEO, OSCP

The Cyber Resilience Act doesn't have a single date of entry into force: it has four staggered milestones between 2024 and 2027, and three of them have already passed. Since September 11, 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents to ENISA, including for products already on the market. One deadline remains: December 11, 2027, when the whole regulation applies. If you manage the development of software products or connected hardware, this timeline tells you what already binds you and what is still ahead.

The Cyber Resilience Act timeline at a glance

The four dates that define Cyber Resilience Act compliance and where each one stands today:

Date	Milestone	Status	What it means
December 10, 2024	Entry into force	Passed	The regulation is already binding law; the countdown starts
June 11, 2026	Rules on notified bodies	In force	Member States can designate the bodies that will assess Class I and II products
September 11, 2026	Article 14 reporting obligations	In force	24h early warning, 72h notification and a final report within 14 days, via ENISA's single reporting platform
December 11, 2027	Full application	Upcoming	The last deadline: every requirement becomes enforceable and punishable

December 10, 2024: the CRA is already in force

Regulation (EU) 2024/2847 was published in the Official Journal of the EU on November 20, 2024 and entered into force twenty days later, on December 10. This milestone does not yet impose direct technical obligations on manufacturers, but it has immediate practical consequences: products being designed and developed right now will be assessed against the CRA requirements when they reach the market. If you launch a new product in 2027 that is in the design phase today, the CRA already shapes its entire lifecycle. Companies with long development cycles—industrial hardware, embedded systems, connected devices—have to start compliance now so they don't discover at the end of 2027 that the product going into production cannot carry the CE marking.

June 11, 2026: designation of notified bodies begins

From this date Chapter IV of the regulation applies, governing how Member States designate conformity assessment bodies and notify them to the Commission. These are the bodies that will have to be involved for important Class II products, critical products and Class I products where the manufacturer does not apply harmonized standards. The fact that bodies can now be designated does not mean any are available yet for your category: check the Commission's NANDO database and book capacity early, because demand will peak in the months before December 2027.

September 11, 2026: the first hard deadline has passed — reporting to ENISA

This was the first deadline with concrete enforceable obligations and it is still the one most companies underestimate — with the added problem that it is already in force. Since September 11, 2026, manufacturers of products with digital elements must report any vulnerability in their product that is being actively exploited: (1) an early warning within 24 hours of becoming aware of it; (2) a vulnerability notification within 72 hours; (3) a final report within 14 days after a corrective or mitigating measure is available. Severe incidents affecting the product's security follow the same 24 and 72-hour pattern, with a final report within one month.

Everything is submitted through ENISA's single reporting platform, which delivers it simultaneously to the coordinating CSIRT of the Member State of the manufacturer's main establishment and to ENISA. Article 69(3) extends the obligation to products already on the market, with no exemption for age. Vulnerabilities that are not being exploited do not have to be reported, although they do have to be fixed.

If your organization does not yet have a working channel for receiving reports, criteria for deciding when a vulnerability counts as exploited, and access to the ENISA platform ready (EU Login accounts with two-factor authentication and the coordinating CSIRT identified), you are not preparing for a future obligation — you are exposed to breaching one that is already enforceable.

December 11, 2027: full application of the CRA

This is the date of full application of all CRA requirements. From this day on, any product with digital elements placed on the European market must: (1) fully comply with the essential requirements of Annex I; (2) have passed the conformity assessment procedure corresponding to its category; (3) have the EU declaration of conformity issued by the manufacturer; (4) bear the CE marking. Products that fail to meet these requirements may not be made available in the EU from this date. National market surveillance authorities will be able to withdraw non-compliant products from the market and impose penalties on manufacturers, importers and distributors.

What happens to products already on the market

The CRA does not require products placed on the market before December 11, 2027 to be withdrawn or certified: under Article 69(1), it only reaches them if they undergo a substantial modification from that date. Two nuances change the planning. The first is the Article 69(3) exception: the obligation to report exploited vulnerabilities and severe incidents does cover all those products from September 11, 2026. The second is that placing on the market is measured per unit, not per model: every unit made available for the first time from December 11, 2027 has to comply, even if the model was launched years earlier.

How to plan your compliance by time horizon

For manufacturers starting now, the reporting obligations are no longer preparation — if they are missing, they are a breach. The immediate priority is to enable a channel to receive vulnerability reports (security.txt, a security contact form or a bug bounty platform), document a minimum assessment and response process, and have access to ENISA's single reporting platform ready: EU Login accounts with two-factor authentication for whoever will file, and the coordinating CSIRT identified. ENISA advises completing registration and validation when a notification is due; it takes minutes. For the only deadline still ahead, December 2027, full compliance requires working on three fronts in parallel: (1) classify every product into its CRA category and determine the type of conformity assessment required; (2) implement the technical requirements of Annex I in the development process (secure SDLC); (3) prepare the technical documentation and the EU declaration of conformity. Companies with experience in product or security certifications (CE marking, ISO/IEC 27001, IEC 62443) start with an advantage, as many controls are reusable.

FAQ

Has the Cyber Resilience Act been passed?

Yes. It is Regulation (EU) 2024/2847, published in the Official Journal of the EU on November 20, 2024 and in force since December 10, 2024. Because it is a regulation rather than a directive, it applies directly in every Member State with no national transposition law. What is staggered is its application: the Article 14 reporting obligations have applied since September 11, 2026, and the rest of the regulation applies from December 11, 2027.

When does the Cyber Resilience Act become mandatory?

It depends on the obligation. Reporting actively exploited vulnerabilities and severe incidents to ENISA has been mandatory since September 11, 2026, including for products already on the market. The Annex I essential requirements, conformity assessment and CE marking are mandatory for every product placed on the EU market from December 11, 2027.

What happens if I don't notify ENISA of an actively exploited vulnerability within the 24-hour deadline?

Breaching the Article 14 obligations falls in the highest tier of the Article 64 penalty regime: up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. National market surveillance authorities are responsible for investigating and imposing these penalties.

Do the CRA deadlines also apply to software updates?

The obligations to report actively exploited vulnerabilities apply to all products with digital elements on the market, regardless of when they were last updated or launched. If an exploited vulnerability affects versions of your software that customers are using, the reporting obligation has applied since September 11, 2026.

Sources

Review my CRA compliance plan