CRA Deadlines 2024-2027: The Staggered Timeline

The Cyber Resilience Act (Regulation (EU) 2024/2847) phases in its obligations in a staggered way over several years, and that is precisely where mistakes happen. Anyone who confuses the date of entry into force with the date of application easily plans too early or too late. This article places every deadline between 2024 and 2027 in context, explains what actually applies on each date, and shows what manufacturers should prepare by when.

The four key dates

The CRA was adopted on 23 October 2024 and published in the Official Journal of the EU on 20 November 2024. Twenty days later - on 10 December 2024 - it entered into force under Art. 71(1). The regulation legally exists from that point, but the obligations for economic operators only become effective at three later moments.

10 December 2024 - entry into force (Art. 71(1))

The starting point of the transition periods. The regulation is valid EU law, but no manufacturer obligation is yet enforceable. Fines, CE-marking duties or reporting obligations cannot be asserted on this date. It marks the start of the preparation period.

11 June 2026 - Chapter IV: notified bodies (Art. 35-51)

The rules for conformity-assessment bodies apply first. Since this day, bodies can be designated as “notified bodies” so that they stand ready when manufacturers later need third-party assessment (relevant above all for important Class II products, for critical products and for Class I products where the Module A route is not open). For manufacturers who do not need third-party assessment, this date creates no immediate duty to act; it shows that the assessment market is starting up.

11 September 2026 - reporting obligations (Art. 14)

Since this day, manufacturers have been required to report actively exploited vulnerabilities and severe incidents via the Single Reporting Platform to the coordinating CSIRT and ENISA. A three-stage cascade applies: an early warning without undue delay and in any event within 24 hours of becoming aware, a notification without undue delay and at the latest within 72 hours, and a final report (for vulnerabilities no later than 14 days after a corrective or mitigating measure is available; for severe incidents within one month of the notification). Importantly: this duty also covers products already on the market (Art. 69(3)). More detail in our article on the CRA reporting obligation since September 2026.

11 December 2027 - general application

The real headline deadline. From here the essential requirements of Annex I, the duty to carry out conformity assessment, the EU Declaration of Conformity and the CE marking apply. Products placed on the market from this date must meet the requirements. Products placed on the market earlier are only subject to them if they undergo a substantial modification afterwards (Art. 69(2)); the reporting obligation under Art. 14 still applies to them (Art. 69(3)).

Timeline at a glance

In other words: the CRA introduces its obligations in three steps. First the assessment infrastructure is set up (June 2026), then the reporting obligation applies (September 2026), and last, with the longest lead time, come the extensive obligations around Annex I, conformity assessment and CE marking (December 2027). This gives manufacturers staggered time to adapt their processes. Anyone who treats 11 December 2027 as the only deadline misses the intermediate steps.

Neighbouring deadlines for context

The CRA does not stand alone. Three neighbouring legal acts help you plan the timeline realistically:

• RED Delegated Regulation (EU) 2022/30: Makes the cybersecurity requirements of the Radio Equipment Directive (Art. 3(3)(d), (e) and (f) of Directive 2014/53/EU) applicable to certain radio equipment from 1 August 2025. Delegated Regulation (EU) 2026/339 repeals it with effect from 11 December 2027 (Art. 1), the date from which the CRA applies in full (recital 4). For radio equipment placed on the market between 1 Aug 2025 and 10 Dec 2027, market surveillance can still check compliance with these requirements after the repeal (recital 5). If you build radio products, develop to CRA requirements right away to avoid rework.
• Machinery Regulation (EU) 2023/1230: Applies from 20 January 2027. Machinery makers with connected products comply with both frameworks; a Cybersecurity Act certificate can give a presumption of conformity for the Machinery Regulation's cybersecurity requirements.
• NIS2 (Directive (EU) 2022/2555): Standalone SaaS or cloud services that are not remote data processing of a product generally fall outside the CRA (recital 12). Whether their provider falls under NIS2 depends on whether it is an entity in a NIS2 sector that meets the size thresholds, for example as a provider of cloud computing services. Germany has transposed NIS2 through the BSI Act of 2 December 2025 (Federal Law Gazette 2025 I No. 301).

Recommended preparation roadmap

The following sequence is general organisational and technical guidance - not legal advice. It follows the staggered timeline:

1. Immediately - scope & classification. Determine whether your products are “products with digital elements” and which class they fall into (default, important Class I/II, critical). The applicability check is the sensible starting point.
2. Immediately - reporting readiness (mandatory since 11 September 2026). Set up reporting channels for the Single Reporting Platform and rehearse the cascade of early warning, notification and final report, including for products already shipped.
3. By mid-2027 - complete your processes. Establish vulnerability handling, a coordinated vulnerability disclosure (CVD) policy, secure update distribution and an SBOM in a machine-readable format. Define the support period: at least five years, shorter only where the expected period of use is shorter (Art. 13(8)).
4. Now to end of 2027 - achieve conformity. Produce the technical documentation (Annex VII), carry out the appropriate conformity assessment, secure capacity at a notified body early where needed (Class II/critical), and prepare the EU Declaration of Conformity and CE marking.
5. By 11 December 2027 - general application. From this day, products newly placed on the market must be conforming and bear the CE marking.