CRA Deadlines & Timeline

Last updated · 8 Jun 2026

Four dates matter for CRA compliance. Below them you will find a plain-English guide to what applies when, plus a live status board on the parts still settling - harmonised standards, the ENISA Single Reporting Platform, and notified-body capacity.

Confirmed CRA dates

Entry into force

10 Dec 2024

Regulation (EU) 2024/2847 becomes law. Transition periods start.

Notified bodies

11 Jun 2026

Rules governing conformity assessment bodies apply. Relevant for Important Class I & II products.

Reporting + SRP live

11 Sep 2026

Vulnerability and incident reporting (Art. 14) and ENISA Single Reporting Platform go live.

Full application

11 Dec 2027

All obligations in force: essential requirements, SBOM, CE marking, technical documentation.

All dates confirmed in Regulation (EU) 2024/2847, Art. 71

What applies to me, and when

Now (since 10 Dec 2024): the regulation is in force; preparation should be underway. By 11 Sep 2026: your vulnerability handling process, CVD policy and ENISA SRP registration must be ready - reporting obligations apply from this date. By 11 Dec 2027: your product must meet all essential requirements, carry a CE mark, have an SBOM and technical documentation in place.

CRA deadlines by obligation and what each requires.
DateWhat appliesWho it affects most
10 Dec 2024Regulation in force. Transition periods running. No product obligations yet.All manufacturers, importers, distributors
11 Jun 2026Notified-body provisions apply. Identify and engage a notified body if you are Important Class I (without full harmonised standard coverage) or Class II.Manufacturers of Important Class I & II, and Critical products
11 Sep 2026Art. 14 reporting obligations live. Must report actively exploited vulnerabilities (24h early warning → 72h notification → 14-day final report) and severe incidents (24h → 72h → 1-month final report) via ENISA SRP.All in-scope manufacturers (micro/small: not fined for missing 24h window)
11 Dec 2027Full obligations: essential requirements (Annex I), SBOM, CE marking, EU Declaration of Conformity, technical documentation (Annex VII, 10-year retention), support period commitments.All in-scope manufacturers, importers, distributors

Not sure if the CRA applies to your product? Try the scope checker. Want to know your product tier? See the product classes page.

The full timeline

Every CRA date, with what it means

From entry into force to full application, with the source for each step.

  1. 10 Dec 2024Confirmed law

    CRA enters into force

    Regulation (EU) 2024/2847 becomes law across the EU. The clock starts on all transition periods. No obligations apply to manufacturers yet - but preparation should begin.

    EUR-Lex, Art. 71

  2. 11 Jun 2026Confirmed law

    Notified-body rules apply

    The provisions governing notified bodies - the third-party conformity assessment bodies required for Important Class I (where harmonised standards not fully applied) and Class II products - become applicable. Manufacturers targeting those tiers need a notified body identified.

    EUR-Lex, Art. 71

  3. 11 Sep 2026Confirmed law

    Reporting obligations live - ENISA SRP operational

    Art. 14 reporting duties apply: manufacturers must report actively exploited vulnerabilities and severe incidents via ENISA's Single Reporting Platform (SRP). Clocks: 24-hour early warning → 72-hour notification → final report within 14 days (vulnerability) or 1 month (severe incident). The SRP itself goes live on this date.

    European Commission, CRA reporting

  4. 11 Dec 2027Confirmed law

    Full application

    All CRA requirements apply in full: essential requirements (Annex I), SBOM, CE marking, EU Declaration of Conformity, technical documentation (Annex VII, kept 10 years), and all manufacturer, importer and distributor obligations. Products placed on the market from this date must be fully compliant.

    EUR-Lex, Art. 71

Live status board

What is settled, and what is still moving

The parts of the CRA framework that are still developing. We mark each one plainly so you are not caught out.

Confirmed lawLive from 11 Sep 2026

ENISA Single Reporting Platform (SRP)

ENISA is building the SRP as the single channel for manufacturers to submit the 24-hour early warnings, 72-hour notifications and final reports required under Art. 14. A single report via the SRP reaches the relevant national CSIRT and ENISA. Manufacturers should register and test access before the September deadline.

ENISA - Single Reporting Platform

In fluxIn development

Harmonised standards (CEN/CENELEC)

CEN/CENELEC (the European standards bodies) are developing harmonised standards under the CRA standardisation request. Products that fully apply a published harmonised standard benefit from a presumption of conformity for the requirements it covers. The standards are not yet published; manufacturers relying on them for Important Class I self-assessment should track progress closely. In the absence of harmonised standards, common specifications may be adopted by the Commission.

European Commission - CRA policy

In fluxOngoing Commission process

Annex III / IV technical descriptions (delegated acts)

The Commission may adopt delegated and implementing acts to clarify and refine the technical descriptions of products in Annex III (Important Class I and II) and Annex IV (Critical). These acts can affect which specific products fall into each tier and the conformity assessment route required. Check the product classes page for the current picture.

EUR-Lex, Annexes III and IV

Confirmed lawRules apply from 11 Jun 2026

Notified bodies (conformity assessment bodies)

Member states are designating notified bodies to assess Important Class I (where harmonised standards not fully applied) and Class II products. The availability and capacity of notified bodies is a practical concern: manufacturers needing third-party assessment should identify and engage a notified body early, as demand is expected to be high ahead of the 11 December 2027 full-application date.

EUR-Lex, Art. 71

Harmonised standards are not yet published

Important Class I manufacturers planning to self-assess by applying harmonised standards cannot rely on that route yet - the standards are still in development by CEN/CENELEC. Until they are published, using a notified body or applying common specifications (if adopted by the Commission) are the available options. European Commission

Changelog

What we changed, and when

This is a living page. Every material edit is logged here.

  • 8 Jun 2026Page created for CRA Facts. Timeline covers entry into force (10 Dec 2024), notified-body rules (11 Jun 2026), reporting obligations and SRP (11 Sep 2026) and full application (11 Dec 2027). Status board covers SRP readiness, harmonised standards, Annex III/IV technical descriptions and notified-body capacity.

Sources

  1. [1]Regulation (EU) 2024/2847 - full text, including Art. 71 (dates)retrieved 8 Jun 2026
  2. [2]European Commission - CRA legislative summaryretrieved 8 Jun 2026
  3. [3]European Commission - CRA reporting obligationsretrieved 8 Jun 2026
  4. [4]ENISA - Single Reporting Platform (SRP)retrieved 8 Jun 2026
  5. [5]European Commission - Cyber Resilience Act policy pageretrieved 8 Jun 2026

The CRA Brief

Get alerted when this changes

We watch Brussels so you don't. Plain-English alerts the moment a CRA deadline, harmonised standard or reporting rule changes.

No spam. Unsubscribe anytime.