Cyber Resilience Act timeline: every date from 2022 to 2028
On this page
The Cyber Resilience Act is often summed up by one date, 11 December 2027. That date matters, but two others have already passed: the rules for conformity assessment bodies have applied since 11 June 2026, and the duty to report exploited vulnerabilities and severe incidents since 11 September 2026. Here is the whole calendar, with what each date means for a maker of software or devices.
The timeline at a glance
| Date | What happens |
|---|---|
| 15 September 2022 | The European Commission proposes the regulation. |
| 30 November 2023 | Parliament and Council reach a political agreement. |
| 12 March 2024 | The European Parliament adopts the text. |
| 10 October 2024 | The Council adopts it. |
| 20 November 2024 | Regulation (EU) 2024/2847 is published in the Official Journal. |
| 10 December 2024 | It enters into force. The transition periods start. |
| 3 April 2025 | CEN, CENELEC and ETSI accept the Commission’s request for harmonised standards (M/606). |
| 1 December 2025 | The technical descriptions of important and critical products are published (Implementing Regulation (EU) 2025/2392, in force on 21 December 2025). |
| 11 June 2026 | The rules on notifying conformity assessment bodies apply (Chapter IV). |
| 27 July 2026 | The Commission publishes its guidance on applying the CRA (Article 26). |
| 11 September 2026 | Reporting obligations apply (Article 14). ENISA’s Single Reporting Platform opens. |
| Late 2026 and 2027 | The harmonised standards are delivered, then cited in the Official Journal. |
| 11 December 2027 | The regulation applies in full. |
| 11 June 2028 | Certificates issued under other EU laws for cybersecurity requirements stop being valid. |
10 December 2024: entry into force
The CRA became law twenty days after its publication. Nothing was required of manufacturers that day: Article 71 gives them 21 months to prepare for reporting and 36 months for everything else.
11 June 2026: notified bodies
Important products of class II and critical products need a third party to assess their conformity, and some class I products do too. From June 2026, Member States can designate and notify those conformity assessment bodies, so that they are in place before December 2027. If your product needs one, now is the time to find it: capacity will be short.
11 September 2026: reporting starts
This is the date most coverage misses. Since 11 September 2026, every manufacturer must report to the authorities, through ENISA’s Single Reporting Platform:
- actively exploited vulnerabilities in its products, and
- severe incidents that affect their security,
with an early warning within 24 hours, a notification within 72 hours and a final report later. The duty covers every product in scope already on the EU market, not only products placed after 2027 (Article 69(3)). Our guide to the 24-hour, 72-hour and 14-day clock explains each step.
Two nuances: according to the Commission’s guidance, exploitation you already knew about before 11 September 2026 does not have to be reported after the fact (if you only learn of it after that date, the clock starts then); and microenterprises and small enterprises cannot be fined for missing the 24-hour early-warning deadline alone (Article 64(10)). The other deadlines still apply to them.
Harmonised standards: late 2026 to 2027
The essential requirements of Annex I are written as outcomes. Harmonised standards will say how to meet them, and following a standard once it is cited in the Official Journal gives a presumption of conformity. The standards bodies are writing about 41 of them: horizontal standards for every product (secure development, vulnerability handling, general requirements) and vertical standards for the categories of important and critical products.
The original deadlines for delivering the first ones to the Commission (August and October 2026) have slipped, and the Commission has proposed new ones. As of late October 2026, no CRA harmonised standard had been cited in the Official Journal. Do not wait for them: the obligations apply on their dates whether the standards exist or not, and mature drafts such as prEN 40000-1-3 on vulnerability handling are already a good guide.
This matters most for class I products: without a cited harmonised standard (or a common specification or certification scheme), self-assessment is not available to them and a notified body is needed (Article 32(2)), except for free and open-source products whose technical documentation is public (Article 32(5)).
11 December 2027: full application
From this date, a product with digital elements placed on the EU market must:
- meet the essential requirements of Annex I (security by design, and vulnerability handling, including an SBOM);
- come with its technical documentation (Annex VII) and an EU declaration of conformity;
- carry the CE marking;
- receive security updates for its support period, normally at least five years.
Importers and distributors take on their own checks, open-source stewards their lighter obligations, and Member States must have their penalty rules in place. Fines reach €15 million or 2.5% of worldwide turnover for breaches of the essential requirements and the manufacturer’s obligations.
Products already on the market before that date do not need to be brought into conformity, unless they are substantially modified afterwards (Article 69(2)). The rule applies to each unit: a model you keep selling after 11 December 2027 must comply for the units placed from then on.
11 June 2028: the last transition
EU-type examination certificates and approval decisions already issued for cybersecurity requirements under other EU laws (for example the Radio Equipment Directive) remain valid until 11 June 2028, unless they expire earlier (Article 69(1)).
What to do now
- Check whether the CRA applies to each product and which class it falls in. Our free check takes five minutes.
- Be ready to report today: know your components, watch them for exploited vulnerabilities, and rehearse the 24-hour early warning.
- Book a notified body if your product is class II or critical, or class I without a standard you can rely on.
- Build the technical file as you go: SBOM for every release, risk assessment, vulnerability-handling process and disclosure policy.
How Provetry helps
Provetry watches every component of your releases for new and exploited vulnerabilities, starts the reporting clock with drafts for ENISA, and keeps the evidence and documentation the CRA asks for, so that each of these dates finds you ready.
This guide is general information, not legal advice.
Sources
- Regulation (EU) 2024/2847, the Cyber Resilience Act, Articles 14, 32, 64, 69 and 71
- Commission Implementing Regulation (EU) 2025/2392 on the technical description of important and critical products
- European Commission: Cyber Resilience Act, implementation and guidance
- ENISA: Single Reporting Platform
- European Commission: guidance on applying the CRA, C(2026) 5252
- CEN-CENELEC: CRA standardisation request accepted