CRA Transition Periods and Key Dates

This article was first published on November 20, 2024, the day the CRA appeared in the Official Journal. The timeline reflects the status as of October 2026. For the full picture, see our page on the Cyber Resilience Act.

On November 20, 2024, the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, was published in the Official Journal of the EU. It marks a new phase in the cybersecurity of products with digital elements. The CRA aims to create a uniform level of security for the European market. It applies directly in all EU member states from December 11, 2027, with only a few exceptions.

What does the CRA mean for companies?

The CRA's requirements apply to manufacturers, importers, and distributors of products with digital elements. The term covers a wide range of devices and applications, such as IoT devices, automation components, machinery, and software. Products placed on the market before December 11, 2027 can also be affected if they are substantially modified afterwards. In addition, the reporting obligations under Article 14 apply to products placed on the market before that date (Article 69(3)). Our article CRA Reporting Obligations for Products Already on the Market explains what this means.

Requirements at a glance

Manufacturers must assess and control the cybersecurity risks of their products, implement effective vulnerability handling, and report actively exploited vulnerabilities. Supply chain security also plays a central role. Importers and distributors have graded obligations, so that the level of security is maintained along the entire value chain.

For details, see our page on the Cyber Resilience Act.

Key dates

Date	Milestone
Nov 20, 2024	The CRA was published in the Official Journal of the EU.
Dec 10, 2024	The CRA entered into force.
Jun 11, 2026	The rules on conformity assessment bodies (Chapter IV) have applied since this date.
Sep 11, 2026	The reporting obligations for manufacturers (Article 14) have applied since this date.
Dec 11, 2027	The CRA applies in full.

What companies should do

The reporting obligations already apply, so manufacturers need a working reporting process today. For the remaining requirements, you should prepare early to reduce risks and make sure you comply. The CRA is a regulatory challenge. It is also an opportunity to strengthen your own cybersecurity for the long term.