IN SHORT
The CRA entered into force on 10 December 2024 and applies in general from 11 December 2027. Two parts apply earlier: the rules on notification of conformity assessment bodies (Chapter IV) from 11 June 2026, and the manufacturers’ reporting obligations (Article 14) from 11 September 2026 — and those reporting obligations also cover in-scope products placed on the market before 11 December 2027. Products placed on the market before that date are otherwise subject to the Regulation only if they are substantially modified from that date.
The dates in the Regulation
| Date | What applies | Source |
|---|---|---|
| 20 November 2024 | Publication in the Official Journal (OJ L, 2024/2847) | — |
| 10 December 2024 | Entry into force: the twentieth day following publication | Article 71(1) |
| 11 June 2026 | Chapter IV (Articles 35 to 51): notification of conformity assessment bodies | Article 71(2), second subparagraph |
| 11 September 2026 | Article 14: reporting of actively exploited vulnerabilities and severe incidents by manufacturers | Article 71(2), second subparagraph |
| 11 December 2027 | General application of the Regulation | Article 71(2), first subparagraph |
| 11 June 2028 | End of the transitional validity of certain existing EU type-examination certificates and approval decisions (see below) | Article 69(1) |
What the text requires
Article 71 states: This Regulation shall apply from 11 December 2027. Article 71(2), first subparagraph
It then sets the two earlier dates: Article 14 applies from 11 September 2026 and Chapter IV (Articles 35 to 51) from 11 June 2026 (Article 71(2), second subparagraph).
Two different “notifications” in 2026
The word “notification” appears in both 2026 milestones, but they concern different people:
- 11 June 2026 — notification of conformity assessment bodies. Chapter IV organises how Member States assess, designate and notify the bodies that will carry out third-party conformity assessments (Article 3, point (26), Article 3, point (29)). Applying it 18 months before the general date allows notified bodies to be in place when manufacturers need them.
- 11 September 2026 — reporting by manufacturers. Article 14 requires manufacturers to notify actively exploited vulnerabilities and severe incidents having an impact on the security of their products to the CSIRT designated as coordinator and to ENISA (Article 14(1), Article 14(3)).
Products already on the market: Article 69
Products placed on the market before 11 December 2027
What the text requires
Products with digital elements placed on the market before 11 December 2027 are subject to the requirements of the Regulation only if, from that date, they are subject to a substantial modification (Article 69(2)).
A “substantial modification” is a change after placing on the market that affects compliance with the essential requirements of Part I of Annex I, or that modifies the intended purpose for which the product was assessed (Article 3, point (30)). The recitals indicate that a security update that only decreases cybersecurity risk without changing the intended purpose is not a substantial modification, while a feature update that changes the intended functions and increases risk can be (Recital 39).
The exception: reporting applies to existing products too
What the text requires
By way of derogation, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027 Article 69(3)
.
Our interpretation
In practice, from 11 September 2026 a manufacturer must be able to report actively exploited vulnerabilities and severe incidents for in-scope products that are already in the field — not only for products placed on the market after December 2027. Preparing the reporting process is therefore the first deadline that bites for most manufacturers, well before the general date of application.
Existing certificates under other EU legislation
EU type-examination certificates and approval decisions issued regarding cybersecurity requirements for products that are subject to other Union harmonisation legislation remain valid until 11 June 2028, unless they expire earlier or that other legislation provides otherwise (Article 69(1)).
An amendment already adopted: Regulation (EU) 2025/327
The European Health Data Space Regulation, Regulation (EU) 2025/327, amends the CRA: it replaces Article 13(4) and Article 31(3) and inserts a new Article 32(5a) concerning products classified as EHR systems. These changes are shown next to the provisions concerned in our regulation explorer, without being merged into the text.
Our interpretation
Our reading of Article 105 of Regulation (EU) 2025/327 is that these amendments apply from 26 March 2027, the general date of application of that Regulation, since the amending article is not listed among its exceptions. This date is our interpretation and is marked as to be verified.
What the timeline does not say
Uncertain / awaiting guidance
The Regulation also relies on later acts of the Commission (delegated and implementing acts) and on harmonised standards, whose adoption dates are not fixed by Article 71. Check the Commission’s CRA page for the current state of these measures rather than assuming a date.
Fictional example — Orbital Routers
Orbital Routers (fictional) has sold the same home router model since 2023 and plans a new model for 2028. From 11 September 2026, if Orbital becomes aware of an actively exploited vulnerability in the 2023 model, it must notify it under Article 14, because that model is in scope and Article 69(3) extends reporting to products placed on the market before December 2027. The 2023 model does not otherwise have to be brought into conformity with Annex I unless it is substantially modified from 11 December 2027. The 2028 model must meet all requirements, including conformity assessment and CE marking, before it is placed on the market.
What to do now
Good practice (recommendation, not a legal requirement)
Plan backwards from the dates that apply to you: set up the reporting process (single point of contact, monitoring of exploitation, 24-hour early warning) before 11 September 2026; for products you will place on the market from 11 December 2027, start the risk assessment, technical documentation and choice of conformity assessment procedure now, and check early whether a notified body will be needed.