Regulation (EU) 2024/2847 — Cyber Resilience Act

Regulation (EU) 2024/2847 of the European Parliament and of the Council

of 23 October 2024

on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

(Text with EEA relevance)

OFFICIAL TEXTRegulation (EU) 2024/2847·Official language version: English (EN)··Retrieved 2 November 2026·View on EUR-Lex

You are reading the text as originally published. Corrigenda published since then are not applied in this view. Regulation (EU) 2025/327 amends Articles 13(4) and 31(3) and inserts Article 32(5a); these changes are marked but not merged. Versions and sources

Contents

Key dates

20 November 2024 — Regulation (EU) 2024/2847 published in the Official Journal (in application)
10 December 2024 — Entry into force (in application)
11 June 2026 — Chapter IV applies: notification of conformity assessment bodies (Articles 35 to 51) (in application)
11 September 2026 — Article 14 applies: manufacturers' reporting obligations (actively exploited vulnerabilities and severe incidents) (in application)
26 March 2027 — Amendments made by Regulation (EU) 2025/327 (European Health Data Space) apply: Article 13(4) and Article 31(3) replaced, Article 32(5a) inserted (upcoming, to verify)
11 December 2027 — General application of the Regulation (upcoming)

Checked against Articles 69 and 71 of the official text. Status as of 2 November 2026.

How to cite and link

Every paragraph has a stable address, for example /regulation/articles/14#par_2. Use the link control beside a paragraph to copy it.

About versions

By default you read the Official Journal text with its published corrigenda applied and marked. You can switch to the text as originally published. Versions and sources

Print

Each article and annex prints with its version, source and address; navigation is left out.

Regulation (EU) 2024/2847 — Cyber Resilience Act

Audience measurement