Cyber Resilience Act timeline

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) entered into force on 10 December 2024 and applies in stages. Rules on notified bodies apply from 11 June 2026, the Article 14 reporting obligations from 11 September 2026, and all remaining obligations from 11 December 2027.

A plain-English summary, not the legal wording and not legal advice. The dates are set by the regulation itself: Official text on EUR-Lex.

1. 10 Dec 2024In effect

   Entered into force

   The regulation became law, but nothing applied to products yet. The period since has been for preparation: standards work, national authority set-up, and manufacturers mapping which of their products with digital elements fall in scope, and which count as important products, since a product’s classification (on fossa.com, opens in a new tab) decides how it is assessed.

2. 11 Jun 2026In effect

   Notified bodies

   The provisions on notifying conformity assessment bodies apply, so member states can designate the notified bodies that third-party assessment will depend on. Manufacturers who need one should not wait until 2027 to find one.

3. 11 Sep 2026Latest stage

   Article 14 reporting

   Manufacturers must report actively exploited vulnerabilities and severe incidents on fixed clocks: an early warning within 24 hours, a notification within 72 hours, then a final report. This applies to every product with digital elements on the EU market, including products placed on the market before full application, so a 24-hour reporting workflow (on fossa.com, opens in a new tab) needs to be in place before the first exploited vulnerability lands.

4. 11 Dec 2027Upcoming

   Full application

   Every remaining obligation applies: the essential cybersecurity requirements, vulnerability handling, conformity assessment, technical documentation and CE marking. The documentation includes a software bill of materials, and the CRA’s SBOM requirements (on fossa.com, opens in a new tab) set out what it must cover. Products placed on the market before this date stay outside most obligations unless they are substantially modified.