CRA enforcement timeline
Every key CRA date — entry into force, transposition deadlines, phased provisions, and compliance milestones. 3 milestones tracked, sourced directly from EUR-Lex.
When does CRA take effect?
CRA (Regulation (EU) 2024/2847) has 3 key enforcement milestones. 1 milestone has already passed; 2 milestones are upcoming. The next key date is 11 September 2026: CRA vulnerability and incident reporting obligations apply.
Next milestone: 11 September 2026 — 122 days away
Source: Regulation (EU) 2024/2847 via EuroComply EU Regulation Deadlines dataset
Total milestones
3
In force
1
Upcoming
2
CRA — complete milestone timeline
Regulation (EU) 2024/2847 · Official text
Cyber Resilience Act enters into force
The Cyber Resilience Act enters into force 20 days after publication (OJ L, 20 November 2024). Application of specific obligations is phased over subsequent years.
Applies to: manufacturers, importers, and distributors of products with digital elements placed on the EU market
Penalty: up to €15M or 2.5% of worldwide annual turnover
CRA vulnerability and incident reporting obligations apply
21 months after entry into force: manufacturers must report actively exploited vulnerabilities and severe incidents affecting security of products with digital elements to ENISA within 24 hours.
Applies to: manufacturers of products with digital elements
Penalty: up to €15M or 2.5% of worldwide annual turnover
CRA full application — all cybersecurity requirements for products with digital elements
36 months after entry into force: all CRA obligations fully apply. Manufacturers must ensure products with digital elements meet essential cybersecurity requirements, perform conformity assessment, affix CE marking, and provide Software Bill of Materials (SBOM).
Applies to: manufacturers, importers, and distributors of hardware and software products with digital elements (IoT devices, connected consumer products, operating systems, apps, etc.)
Penalty: up to €15M or 2.5% of worldwide annual turnover
Embed a countdown widget
Add a live CRA deadline countdown to your website or intranet with a single script tag.
Browse embed widgets →Does CRA apply to your business before the deadline?
Find out in 2 minutes with our free regulation checker.
Check scope — freeFor informational purposes only. This is not legal advice — consult qualified legal counsel for advice specific to your situation. Dates reflect official EUR-Lex sources; verify with your national competent authority for jurisdiction-specific transposition dates.
Last updated: