Article 14 reporting obligations have applied since 11 September 2026. Next: Full application, 11 Dec 2027.

Full timeline

EU Cyber Resilience Act (CRA)

The Online Home for CRA Practitioners

Your go-to community for the EU Cyber Resilience Act. Stay informed with the latest updates, share practical insights, and get answers from experts and peers.

  • Peer communityConnect & collaborate
  • Expert insightsLearn from the best
  • Stay aheadTimely updates & alerts

The next wave of CRA requirements takes effect

11 Dec 2027

Are you ready?

View timeline

The CRA clock

Full timeline
  1. 10 Dec 2024

    Entered into force

    The regulation is law. Obligations phase in from here.

  2. 11 Jun 2026

    Notified bodies

    Conformity assessment bodies can be notified by member states.

  3. 11 Sep 2026

    Article 14 reportingIn effect

    Actively exploited vulnerabilities and severe incidents must be reported.

  4. 11 Dec 2027

    Full application

    All remaining obligations apply.