Key CRA Enforcement Dates
The CRA entered into force on December 10, 2024 (the twentieth day after publication in the Official Journal on 20 November 2024, Article 71(1)). Here is the implementation timeline:
June 11, 2026
Notified body provisions apply. Chapter IV (Articles 35 to 51) on the notification of conformity assessment bodies applies from this date.
September 11, 2026 (21 Months)
Article 14 Reporting Begins (Early Enforcement). Manufacturers must start reporting actively exploited vulnerabilities and severe incidents to the CSIRT designated as coordinator and to ENISA, starting with an early warning within 24 hours.
December 11, 2027 (36 Months)
Full Application Date. All products with digital elements must comply with the essential security requirements, carry the CE mark, and supply a DoC.
What About Products Already on the Market?
Products placed on the market before 11 December 2027 become subject to the CRA requirements only if they undergo a substantial modification from that date (Article 69(2)). The Article 14 reporting obligations are an exception: they apply to all in-scope products, including those placed on the market earlier (Article 69(3)).
Get the CRA deadline calendar
A one-page PDF showing every CRA date that matters for your product team. Free — no spam, unsubscribe anytime.
Related articles
Ready to Take Action?
Start your CRA compliance journey with our free assessment tool.