Cyber Resilience Act Timeline: Every Key Date, 2024 to 2028

Part of the EU Cyber Resilience Act guide, chapter 02: CRA timeline and penalties

The CRA rolls out across five milestones between December 2024 and December 2027, plus a tail date in June 2028. The first operational one, Article 14 reporting, has applied since September 11, 2026. It reaches the products you shipped years ago alongside the ones on your 2028 roadmap, which makes 2026 an active compliance year.

Below is every milestone in order, what switches on at each one, why Brussels wrote a 36-month transition period, what enforcement looks like, and the sequence a hardware team should work in if product security became someone's job last month.

Jump to: Timeline at a glance · Why 36 months · September 11, 2026 · December 11, 2027 · Enforcement and penalties · Products already on the market · FAQ

The Cyber Resilience Act timeline at a glance

The bold rows are the five milestones. Two of them, September 2026 and December 2027, change what you have to do. The rest set up the machinery that makes those two workable.

December 10, 2024: the clock started

The regulation entered into force. Nothing became enforceable that day. The transition period everyone is living through began, and every downstream date counts from here.

If you want the substance of what the regulation asks for rather than when it asks, start with the EU Cyber Resilience Act explainer and come back to the calendar.

Why does the Cyber Resilience Act have a 36-month transition period?

The CRA gives manufacturers 36 months because the co-legislators judged 24 too short for hardware redesign, standards development, and building third-party assessment capacity.

The Commission's September 2022 proposal set full application at 24 months after entry into force, with reporting at 12. Parliament and Council both pushed the main deadline to 36 months. On reporting they split three ways: the Commission at 12 months, the Council at 18, Parliament at 24. The political agreement on November 30, 2023 landed on 36 months for the regulation and 21 months for reporting. [VERIFY-02]

The reasoning follows the dependency chain:

1. Hardware cycles. Secure by design is decided at architecture time. A device in design in 2025 ships in 2027 or 2028, so a shorter window would have caught products already locked.
2. Standards. Manufacturers need harmonised standards to claim a presumption of conformity, and standards bodies needed time to write them under the Commission's standardisation request.
3. Assessor capacity. Notified bodies had to be designated and accredited before important and critical products could be assessed, which is why Chapter IV switches on at 18 months.

Some industries argued even that was too short; machinery makers asked for a further extension during negotiations and didn't get it.

The 21-month reporting date sits earlier on purpose. Reporting needs a process, an inventory, and a named filer, all of which take less time to build than a redesigned product, so the legislators made it bind first.

June 11, 2026: the conformity assessment plumbing turns on

From this date the rules for notifying conformity assessment bodies apply. In plain terms: member states can start designating the third parties allowed to assess higher-risk products, and those bodies can start getting accredited.

This date matters most if your product lands in the important or critical classes, where self-assessment may not be available. Notified body capacity is finite, and it gets booked. Teams that wait until 2027 to find an assessor will be queuing behind teams that started in 2026.

Worth knowing before you book anything: what a CRA conformity assessment actually asks you to produce.

September 11, 2026: reporting went live, including on products you already shipped

Since September 11, 2026, manufacturers have had to report actively exploited vulnerabilities and severe security incidents through ENISA's Single Reporting Platform, which went live the same day. The clocks are short:

• 24 hours: early warning to your coordinating CSIRT and ENISA, from the moment you become aware
• 72 hours: notification with general information and any corrective or mitigating measures taken
• 14 days or one month: final report, within 14 days of a corrective measure becoming available for a vulnerability, or one month for a severe incident

Here's the part people miss. This applies to every in-scope product already on the EU market, whatever its launch date or certification status. The fleet you shipped in 2021 counts.

That changes what "readiness" means. Hitting a 24-hour clock takes three things working today:

1. A software inventory grounded in what actually shipped. If you can't answer "which SKUs and which firmware versions contain this component" in minutes, the 24-hour window is gone before you've written a sentence. A software inventory built from firmware and binaries, rather than from what the build system thinks it produced, is what makes that query answerable.
2. A way to tell exploited from theoretical. The obligation triggers on actively exploited vulnerabilities, so separating real exposure from CVE noise now sits on the reporting path. Reachability analysis is how teams do that at portfolio scale.
3. A PSIRT process with a named owner and a rehearsed path. Who files the early warning at 2 a.m. on a Sunday? There's no reporting API yet, so filing is a manual web submission. Our notes on rapid PSIRT vulnerability response cover the workflow.

The test worth running this quarter: "If a CVE in our fleet were exploited tomorrow, could we file in 24 hours?" Run it as a tabletop exercise and you'll find your gaps cheaply.

Harmonized standards: where they actually stand

As of October 2, 2026, no CRA harmonised standard is cited in the Official Journal, so none of them gives you a presumption of conformity yet. ETSI put 17 product-specific final drafts out for public enquiry in August, and the first horizontal CEN-CENELEC standards are moving toward ratification. A Commission draft amendment proposes delivery deadlines of October 31, 2026 for the horizontal and vulnerability-handling standards and December 31, 2026 for the product-specific ones. [VERIFY-03]

Delivery and citation are separate steps. Conforming to a cited harmonised standard gives you a presumption of conformity: you demonstrate you met the standard, and the relevant CRA essential requirement is presumed satisfied. Until citation, you're building the argument yourself and defending your own interpretation to an assessor.

The Commission also published its Article 26 implementation guidance on July 27, 2026, roughly 80 pages working through the questions manufacturers ask most. It's non-binding, carries no presumption of conformity, and shows how the Commission reads the text.

The practical move is to track which drafts cover your product category and design against them now. Retrofitting a shipped design to a standard cited in 2027 is the expensive version of this.

December 11, 2027: full application, and no CE mark means no market access

Everything else switches on. That includes:

• Secure by design and secure by default requirements
• Vulnerability handling across the declared support period
• Technical documentation
• The EU Declaration of Conformity
• CE marking

From that date, a new product without CRA conformity cannot be placed on the EU market. There's no grace window for new placements and no partial credit. No CE mark, no market access.

Two of those five items are where hardware teams lose time. Secure by design is an architecture commitment, so it gets decided in 2026 for products shipping in 2028: see the security by design guide for the CRA. And technical documentation is an evidence exercise that depends on knowing what's inside every product, which is why SBOMs and technical documentation under the CRA deserve their own workstream starting now.

When is the CRA enforced, and what are the penalties?

Reporting has been enforceable since September 11, 2026; everything else applies from December 11, 2027, with fines up to €15 million or 2.5% of turnover.

Market surveillance authorities in each member state enforce the CRA. Article 64 sets three penalty tiers:

Article 14 sits in the top tier, so a missed 24-hour early warning on a product you shipped in 2021 is exposed to the same ceiling as a non-conforming product in 2028. Microenterprises and small enterprises can't be fined for missing the 24-hour early warning deadline specifically. [VERIFY-04]

Authorities can also order a product withdrawn or recalled across the EU. For a manufacturer with a large installed base, that order usually costs more than the fine.

Does the CRA apply to products already on the market?

Products placed on the EU market before December 11, 2027 don't need CE marking or a conformity assessment, unless you substantially modify them after that date.

That's Article 69 of Regulation (EU) 2024/2847, and it's the part of the timeline most often read backwards. Three paragraphs do the work:

• Article 69(1). EU type-examination certificates issued under other Union harmonisation legislation stay valid until June 11, 2028, six months past full application. Compliance plans that sunset RED-era certificates in December 2027 are giving away half a year. [VERIFY-05]
• Article 69(2). Units placed on the market before December 11, 2027 are grandfathered, until a substantial modification as defined in Article 3(30) trips the trigger.
• Article 69(3). The single carve-back. Article 14 reporting applies to every in-scope product, including the fleet you shipped in 2021.

The unit of measurement is the individual unit, not the product line. A router placed on the market in November 2027 is grandfathered. The next 5,000 copies of that same router, placed on the market in January 2028, need CRA conformity. The Commission's guidance works through that exact example.

So the precise version of "no grace window" is this: none for new placements, a permanent one for old ones, and Article 14 reporting stapled to both. The question worth answering per SKU is when each unit was first placed on the EU market, and what your next release does to it.

What the CRA timeline means for IoT and connected device manufacturers

IoT and embedded device makers hit the timeline harder than software vendors, for one structural reason: your support periods outlast the deadlines.

A sensor shipped in 2026 with a ten-year support commitment is still in the field in 2036. It's grandfathered from the essential requirements under Article 69(2), and it's reportable under Article 14 for its whole life. That's a decade of vulnerability monitoring on a product that never gets a CE mark under the CRA.

Secure by design for IoT also decides itself early. A device fixes its bootloader, its update mechanism, and its cryptographic primitives at tape-out, long before a web team would schedule the equivalent change in a sprint. Products shipping in 2028 are having their CRA architecture decided in 2026 design reviews happening now.

Then there's classification. Commission Implementing Regulation (EU) 2025/2392, in force since December 21, 2025, gives the technical descriptions for the important and critical categories in Annexes III and IV. [VERIFY-06] Classification turns on a product's core functionality, so an embedded browser inside a larger application doesn't make the product a browser. If you've been guessing at your class since 2024, that regulation is where the guessing stops.

Key takeaways

• The Cyber Resilience Act timeline has five milestones: December 10, 2024, June 11, 2026, September 11, 2026, December 11, 2027, and the June 11, 2028 certificate tail.
• The 36-month transition reflects hardware cycles, standards, and assessor capacity. Reporting binds at 21 months because it needs a process and an inventory, which take less time than a redesign.
• Reporting has applied since September 11, 2026, to products already on the EU market, on a 24-hour early warning and 72-hour notification clock.
• June 11, 2026 opened the notified body pipeline. Important and critical class products should already be booking assessors.
• No harmonised standard is cited yet. Design against the drafts.
• December 11, 2027 is absolute for new placements. Penalties reach €15 million or 2.5% of turnover.
• 2026 is about seeing and reporting. 2027 is about the product standing up to scrutiny. Different work, different lead times.

Where to go from here

The closest date for most manufacturers is now December 11, 2027, and reporting is already running underneath it. If your inventory and filing path aren't rehearsed, fix that first. Then work backward from 2027: classification, architecture decisions for 2028 products, and the evidence for your technical file.

If you'd rather see what that looks like against your own products than plan it on a whiteboard, request a CRA walkthrough and we'll map your portfolio to the milestones above. Already know where the gaps are? Start with a CRA readiness assessment.

FAQ

What's the timeline for the EU Cyber Resilience Act?

The CRA entered into force on December 10, 2024. Rules for notifying conformity assessment bodies applied from June 11, 2026. Article 14 reporting has applied since September 11, 2026. Full application, including CE marking and the essential requirements, starts December 11, 2027. Existing EU type-examination certificates remain valid until June 11, 2028.

When is the Cyber Resilience Act enforced?

In two stages. Reporting of actively exploited vulnerabilities and severe incidents has been enforceable since September 11, 2026, including for products already on the market. Every other obligation, including the essential requirements, conformity assessment, and CE marking, becomes enforceable on December 11, 2027.

What are the penalties for CRA non-compliance?

Up to €15 million or 2.5% of worldwide annual turnover for breaches of the essential requirements or the manufacturer obligations in Articles 13 and 14. Other breaches reach €10 million or 2%, and misleading information €5 million or 1%. Authorities can also order products withdrawn or recalled.

Why does the CRA have a 36-month transition period?

The Commission proposed 24 months. Parliament and Council extended it to 36 to allow time for hardware redesign, harmonised standards, and notified body capacity. Reporting was set earlier, at 21 months, because it depends on processes and inventory that take less time to build than a redesigned product.

Are CRA harmonised standards available yet?

Drafts are, but none is cited in the Official Journal as of October 2, 2026, so none yet gives a presumption of conformity. Delivery deadlines have been proposed for October 31 and December 31, 2026. Citation is a separate step that follows delivery.

Previous chapter: What the CRA is and who it applies to · Next chapter: Essential requirements and security by design