CRA timeline: the Cyber Resilience Act dates from 2026 to 2027
The Cyber Resilience Act does not arrive all at once. Reporting already applies; the product requirements follow in December 2027. Here are the dates, what each one changes, and what to have ready.
The dates
- 10 December 2024: the Regulation enters into force.
- 11 June 2026: the rules on notifying conformity assessment bodies (Chapter IV) apply.
- 11 September 2026: reporting under Article 14 applies: actively exploited vulnerabilities and severe incidents, through ENISA’s Single Reporting Platform. It covers every product on the market, including those placed on it before.
- 11 December 2027: everything else applies: the essential requirements of Annex I, the technical documentation, conformity assessment, the EU declaration of conformity and the CE marking.
Products already on the market
A product placed on the market before 11 December 2027 only has to meet the full requirements if it is substantially modified after that date (Article 69). Reporting is different: Article 14 already applies to it.
What to have ready
- Now: a way to qualify an event, record when you became aware and send the 24-hour early warning, with people registered on ENISA’s platform. Our guide on reporting an actively exploited vulnerability walks through it.
- Before December 2027: an SBOM for each version, a support period decided and announced for each product, a coordinated vulnerability disclosure policy, and the technical documentation.
Fines for breaching the essential requirements and the obligations of Articles 13 and 14 can reach €15 million or 2.5% of worldwide annual turnover, whichever is higher. Micro and small enterprises are not fined for missing the 24-hour early warning alone (recital 120).
Clearlane CRA covers the reporting part today, and keeps products, versions, support periods and SBOMs in Jira for 2027.
Source: Regulation (EU) 2024/2847, Articles 14, 64, 69 and 71. Checked on 16 October 2026.