Answer the questions and see the reasoning.
10 December 2024: entry into force
The CRA was published in the Official Journal on 20 November 2024 and entered into force on 10 December 2024. Entry into force and the dates on which particular obligations apply are different milestones.
Do not use the publication date as the start of an incident deadline or assume that every product obligation applied immediately. Article 71 sets the staged application dates.
11 June 2026: conformity assessment bodies
Chapter IV applies from 11 June 2026, establishing the notification framework for conformity assessment bodies. This supports the infrastructure needed for third-party product assessments.
A body’s commercial description as a certification provider is not enough to establish that it is a CRA notified body. Check its notification and scope in the official system before engaging it for a required procedure.
11 September 2026: reporting duties
Manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security under Article 14. The initial outer limits are 24 and 72 hours from awareness, alongside the duty to act without undue delay.
This applies to in-scope products already placed on the market, including before December 2027. The Commission guidance explains that active exploitation already known before reporting starts need not be reported retrospectively merely because the date arrives. New awareness after that date needs a fresh assessment.
11 December 2027: general application
Most obligations apply from this date, including essential requirements, the relevant conformity assessment, documentation and marking duties for products newly placed on the market.
Under Article 69(2), products placed on the market before this date are subject to the CRA requirements only if they undergo a substantial modification from that date, without prejudice to the earlier reporting provisions. Distinguish a model’s first launch from the placement of the actual unit or software version.
Turn the dates into a preparation sequence
First map products, roles and responsible teams. Prepare reporting workflows and accurate awareness records. Then complete category decisions, risk assessment, support-period decisions and a conformity plan for the products you will place on the market.
The general application date is not a deadline extension for an individual report. The reporting calculator uses event timestamps, while the modification checker helps assess the treatment of changes to existing products.
Frequently asked questions
Can I wait until December 2027 to report incidents?
Manufacturers must report under Article 14 from 11 September 2026, including for older in-scope products. The separate reporting obligations of open-source software stewards under Article 24(3) apply from 11 December 2027 under Article 71(2).
Is a product launched in 2025 always grandfathered?
No. Examine the individual product placement and subsequent modifications. New units or relevant software versions supplied later are not automatically covered by an earlier model launch.