The Cyber Resilience Act, Regulation (EU) 2024/2847, phases in over three years. It entered into force on 10 December 2024, the conformity assessment body provisions apply from 11 June 2026, the reporting obligations apply from 11 September 2026, and the main obligations apply from 11 December 2027. Reading these dates as a sequence rather than a single deadline is the key to planning.
The phasing is deliberate. Conformity assessment bodies need to be in place, from 11 June 2026, before manufacturers can rely on them, which is why Chapter IV applies first. Reporting comes next, from 11 September 2026, so that authorities begin receiving early warnings of actively exploited vulnerabilities and severe incidents well ahead of full application. The main obligations, from 11 December 2027, then apply to the body of manufacturer duties.
For planning, treat 11 September 2026 as your first hard operational date and 11 December 2027 as the point by which your full compliance posture must already be in place.
Older products are handled by Article 69. Products placed on the market before 11 December 2027 fall under the full requirements only if they are substantially modified after that date. The reporting obligations, however, apply regardless. So an unmodified legacy product avoids the full body of requirements, but you still owe the Article 14 reporting duties for it.
Some obligations extend far beyond these dates. Technical documentation and the EU declaration of conformity must be retained for at least 10 years after the product is placed on the market, or for the support period if longer (Article 13(13)), and the support period is itself at least 5 years unless a shorter expected product lifetime justifies less (Article 13(8)). The timeline does not end at 2027; it sets records obligations that run for years afterwards.
CRANIS2 tracks each product against these dates, so you can see what applies now, what applies from September 2026, and what must be ready by December 2027, and it manages the long-tail retention and support-period clocks that outlast them. Work out how long your products must be supported with our end-of-life calculator.
It is the date the CRA's main obligations apply under Article 71(2). It is better understood as a date of application than a deadline you work back from: your compliance posture should already be in place by then, not started on it.
For most manufacturers, the Article 14 reporting obligations, which apply from 11 September 2026, are the first operational duty, ahead of the main obligations on 11 December 2027.
Not entirely. Under Article 69, products placed on the market before 11 December 2027 fall under the full requirements only if substantially modified after that date, but the reporting obligations apply regardless.
Related guides: CRA reporting obligations from September 2026 and Does the CRA apply to my product?.