Deadline
High impact
September 11, 2026
CRA Single Reporting Platform goes live — AR User Manual published
ENISA deployed the initial operating capability of the CRA Single Reporting Platform (SRP) at portal.cra-srp.enisa.europa.eu, coinciding with the Article 14 reporting obligations taking effect. Alongside the launch, ENISA published the AR User Manual (10 September 2026) — step-by-step guidance with screenshots covering Assigned Representative registration, EU Login authentication (now confirmed to require multi-factor authentication), notification submission across the early-warning, 72-hour, and final-report stages, manufacturer association management, and dashboard monitoring.
Action required
The platform is live: register your Assigned Representative(s) with MFA-enabled EU Login and rehearse the notification workflow using the SRP Reporting Wizard and the official AR User Manual before you need to submit a real notification.
srp
article-14
reporting
eu-login
assigned-representative
ar-user-manual
Official source →
Standard
High impact
August 13, 2026
ETSI opens Public Enquiry on 17 draft CRA product standards
ETSI put 17 final-draft European Standards under Public Enquiry — the first wave of product-specific (vertical) standards translating CRA Annex I essential requirements into testable technical criteria for categories including password managers, routers, smart home hubs, connected toys, and wearables. The draft texts are publicly readable now; comment windows close on a rolling basis between mid-September and mid-November 2026, with final versions expected by December 2026. These are not yet cited in the Official Journal, so they do not yet carry a formal presumption of conformity under Article 27.
Action required
Review the draft ETSI standard(s) matching your product category now — the texts are public even before final adoption — and track them in the Harmonised Standards Tracker. Do not treat draft-stage standards as a presumption of conformity until an OJEU citation follows.
etsi
harmonised-standards
annex-i
conformity
public-enquiry
product-security
Official source →
Guidance
Medium impact
August 6, 2026
ENISA expands CVE Root to 20 CVE Numbering Authorities
ENISA scaled up its role as a CVE Program Root (assumed in November 2025), onboarding new CVE Numbering Authorities including NATO's NCIA and eight organisations transferred from the MITRE Root, bringing its total to 20 CNAs. This strengthens the EU vulnerability-coordination infrastructure — including the European Vulnerability Database (EUVD) — that underpins CRA Article 14 reporting.
Guidance
High impact
August 3, 2026
ENISA publishes operational guidance for the CRA Single Reporting Platform
ENISA updated its CRA Single Reporting Platform FAQs and published a two-page reporting factsheet plus step-by-step guidance for Assigned Representative registration and notification submission. The guidance confirms EU Login authentication, selection of the designated national CSIRT, and a single notification workflow for early warnings, 72-hour notifications, final reports, drafts, and updates. ENISA advises registering when a specific notification is needed rather than creating an account pre-emptively; CSIRT validation can continue in parallel without blocking submission.
Action required
Prepare EU Login and Primary/Backup Assigned Representative responsibilities, identify your designated national CSIRT, and rehearse the SRP submission workflow. Register when an actual notification needs to be submitted and consult ENISA guidance for updates.
enisa
srp
article-14
reporting
eu-login
assigned-representative
csirt
Official source →
Guidance
Medium impact
July 30, 2026
ENISA publishes Secure by Design and Default Playbook for SMEs
ENISA published version 1.0 of its practical Secure by Design and Default Playbook. The 22 playbooks turn security principles into concise checklists, minimum evidence, and release gates covering architecture, secure coding, vulnerability management, supply-chain controls, secure defaults, updates, and end-of-life. The guidance supports CRA preparation but is informational and does not add or replace legal requirements under Regulation (EU) 2024/2847.
Action required
Use the release gates as a practical review layer: store an SBOM per release, run security scans, time-bound risk exceptions, review sensitive changes, sign artifacts, and verify critical suppliers.
enisa
secure-by-design
secure-by-default
sme
release-gates
evidence
supply-chain
Official source →
Guidance
Medium impact
July 29, 2026
CISA and international partners publish 2026 SBOM Minimum Elements
CISA and international cybersecurity agencies updated the 2021 NTIA SBOM baseline. The 2026 edition defines 17 data fields, adding component hashes, licenses, SBOM author signature, format and document versions, generation context, and tool details. It also recommends complete transitive coverage, one SBOM per release, explicit unknowns, and machine-processable delivery. DG CONNECT contributed, but the document explicitly does not interpret EU law and is not CRA implementation guidance.
Action required
Treat the 17 fields as a recommended SBOM quality baseline while retaining the CRA legal minimum separately. Add hashes, relationships, authorship, signatures, and generation metadata where available.
Guidance
High impact
July 27, 2026
Commission publishes official guidance on Cyber Resilience Act implementation
The European Commission published Communication C(2026) 5252 and its Annex — non-binding but authoritative guidance addressing the exact topics mandated under Article 26: when products fall within scope (including remote data processing solutions and free and open-source software), what constitutes a "substantial modification", how support periods should be understood and applied, and how to meet reporting and risk-assessment obligations. The guidance includes 67 practical examples, flowcharts, and use cases aimed particularly at microenterprises and SMEs. Reporting obligations already apply from 11 September 2026; main obligations from 11 December 2027.
Action required
Review the Annex to C(2026) 5252 for clarifications on scope (remote data processing / FOSS), substantial modification, and support-period determination that may affect your product classification and documentation.
scope
substantial-modification
support-period
reporting
foss
remote-data-processing
sme
article-26
Official source →
Guidance
High impact
June 4, 2026
ENISA publishes Technical Competence Requirements for CRA Notified Bodies
ENISA released high-level competence requirements for personnel at Conformity Assessment Bodies (CABs) seeking designation as CRA Notified Bodies — covering auditors and evaluators. This is directly linked to the 11 June 2026 deadline by which EU Member States must designate their notifying authorities. Manufacturers whose products require third-party conformity assessment (Class I without harmonised standards, all Class II) should use this guidance to evaluate whether their chosen CAB will be accredited.
Action required
If you require a third-party Notified Body (Class I or Class II products), verify your chosen CAB is seeking or has received designation under these requirements.
Guidance
Medium impact
March 3, 2026
European Commission publishes draft interpretive guidance on CRA provisions
The Commission published draft guidance for public feedback to assist companies in interpreting and applying CRA provisions, including scope clarifications, conformity assessment pathways, and obligations for importers and distributors. The guidance is not yet legally binding — a final version is expected later in 2026. Manufacturers should review it now as it signals the Commission's official interpretation of ambiguous provisions.
Action required
Review the draft guidance and submit feedback if your product sits in a grey area (e.g., B2B-only software, embedded components, open-source projects).
Deadline
High impact
February 20, 2026
September 2026: SRP goes live, vulnerability reporting becomes mandatory
Article 14 reporting obligations apply from 11 September 2026 (Article 71(2)), and ENISA's Single Reporting Platform (Article 16) is the submission point for Article 14 notifications. Chapter IV (notified bodies) applies from 11 June 2026; the rest of the Regulation applies from 11 December 2027. Market surveillance authority powers are not tied to a separate 11 September 2026 date.
Action required
Prepare your Assigned Representative registration and notification workflow using ENISA's current SRP guidance.
Amendment
High impact
January 14, 2026
Check your product classification against Implementing Regulation (EU) 2025/2392
Implementing Regulation (EU) 2025/2392 gives the technical descriptions of the important (Class I / Class II) and critical product categories in CRA Annexes III and IV. Manufacturers should re-check their classification against it before planning conformity assessment. The Commission can still amend the Annex III and IV lists by delegated act (Articles 7(3) and 8).
Action required
Verify your product classification against Implementing Regulation (EU) 2025/2392 and Annexes III and IV of the CRA.
Amendment
Medium impact
December 11, 2025
Delegated Regulation (EU) 2026/881 — conditions for CSIRTs delaying onward dissemination of notifications
Commission Delegated Regulation (EU) 2026/881, adopted 11 December 2025 and published in the Official Journal on 20 April 2026, specifies the terms and conditions for the cybersecurity-related grounds in Article 16(2) of the CRA. They let the CSIRT that first receives an Article 14 notification delay passing it to the other relevant CSIRTs, only for as long as strictly necessary. Grounds: (1) the sensitivity of the notified information (Article 3) — for example the manufacturer expects a mitigation within 72 hours, the notification contains enough to create an exploitation technique, the CSIRT can share enough for others to mitigate, or the vulnerability reached the CSIRT through coordinated vulnerability disclosure; (2) a specific receiving CSIRT that was affected by an incident or cannot ensure confidentiality (Article 4); (3) an incident affecting the single reporting platform (Article 5). The delay is a CSIRT decision, not a manufacturer entitlement. It does not change the 24-hour, 72-hour and final-report deadlines that apply to the manufacturer.
Action required
No manufacturer action is required by this act. Do not assume immediate cross-border propagation of your notification, and state clearly in your notification in which Member States the product is made available.
Amendment
High impact
November 28, 2025
Implementing Regulation (EU) 2025/2392 — technical descriptions of important and critical product categories
Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 sets out the technical descriptions of the categories of important products (Annex III of the CRA: Class I with 19 categories, Class II with 4) and critical products (Annex IV: 3 categories). A product is classified on the basis of its core functionality, not because it can perform some functions of a category. Integrating an important or critical component does not by itself make the host product important or critical. Check the Official Journal text for the exact descriptions.
Action required
Check your product against the technical descriptions in Regulation (EU) 2025/2392 and CRA Annexes III and IV. Class II products must always use a third-party conformity assessment procedure; Class I products can use module A only if harmonised standards, common specifications or certification schemes are applied in full (Article 32).
classification
class-i
class-ii
critical
implementing-regulation
product-list
Official source →
Guidance
Medium impact
November 20, 2025
ENISA elevated to CVE Root — gains authority to govern EU vulnerability identifiers
ENISA was elevated from CVE Numbering Authority (CNA) to full CVE Root status. ENISA can now onboard and govern other CNAs across its EU scope, assign CVE IDs autonomously, and coordinate vulnerability disclosures across EU CSIRTs. This directly supports CRA Article 14's mandatory vulnerability reporting infrastructure and means ENISA's European Vulnerability Database (EUVD) will have authoritative CVE coverage for EU-originated vulnerabilities.
Guidance
High impact
May 13, 2025
ENISA launches European Vulnerability Database (EUVD) — official EU vulnerability reference
ENISA launched the European Vulnerability Database (EUVD) at euvd.enisa.europa.eu. It aggregates vulnerability intelligence from EU CSIRTs, vendors, CVE records, and CISA's KEV catalogue, providing severity scores, exploitation status, and mitigation measures. Under CRA Article 14, manufacturers must report actively exploited vulnerabilities to ENISA — the EUVD is now the authoritative EU source for tracking exploitation status and confirming whether a vulnerability has been publicly disclosed. Use it alongside CISA KEV for CRA reporting decisions.
Action required
Add EUVD (euvd.enisa.europa.eu) to your vulnerability monitoring workflow. Check it before determining whether Article 14 reporting is triggered.
Deadline
High impact
December 10, 2024
Regulation (EU) 2024/2847 enters into force
The Cyber Resilience Act was published in the Official Journal on 20 November 2024 and entered into force on 10 December 2024, the twentieth day after publication (Article 71(1)). Under Article 71(2) it applies from 11 December 2027, except Article 14 (vulnerability and incident reporting), which applies from 11 September 2026, and Chapter IV (notification of conformity assessment bodies, Articles 35 to 51), which applies from 11 June 2026.
Action required
Use the Assessment to determine your classification and compliance roadmap.