Cyber Resilience Act Deadlines: What Applies and What's at Stake

Many organizations still treat the Cyber Resilience Act as a deadline that starts in December 2027. That is only part of the picture. The CRA does not take effect all at once. It applies in stages, and one of its most demanding stages, the reporting obligation under Article 14, is already in force.

Since September 11, 2026, if you manufacture products with digital elements, you must report actively exploited vulnerabilities and severe security incidents through the CRA Single Reporting Platform. ENISA operates the platform and forwards each notification to the coordinating national CSIRT (in Germany, CERT-Bund at the BSI) and, where relevant, to further CSIRTs and market surveillance authorities. This obligation applies to products already on the market, not just new ones. Even so, a survey by the German digital industry association Bitkom found that only three in ten companies consider themselves prepared for the CRA, and fewer than a third say they understand what it actually requires of their own organization.

If you’re responsible for planning your organization’s compliance work, the practical question isn’t just what the CRA requires. It’s when each requirement starts to bind you, and what that means for how you sequence the work.

The Three CRA Deadlines You Need to Know

The CRA sets three dates that matter, and each one brings a different part of the regulation into force for a different group of actors. Assuming that all obligations start on the full-applicability deadline of December 11, 2027 means missing the reporting obligation that already applies now, with direct consequences for how you need to plan your compliance work.

Date	What it brought into force	Who it affects
June 11, 2026	Chapter IV of the CRA (Articles 35–51): member states could begin designating the notifying authorities responsible for accrediting notified bodies	Manufacturers of important or critical products under Annex III and IV, who need third-party conformity assessment rather than self-assessment
September 11, 2026	Article 14: the obligation to report actively exploited vulnerabilities and severe security incidents	All manufacturers of products with digital elements, including products already on the market
December 11, 2027	Full applicability of the remaining CRA requirements, backed by CE marking and conformity assessment	New products placed on the EU market from this date; existing products only if substantially modified after it

The first date, June 11, 2026, was the least visible of the three but set the conformity assessment process in motion. For standard products, it has no direct effect: self-assessment remains the route to market. For important or critical products, it marked the point from which the bodies you’ll eventually need to work with could start being accredited.

The second date, September 11, 2026, brought Article 14 into force. This obligation applies broadly: to standard, important, and critical products alike, and to products placed on the market before this date as well as new ones.

The third date, December 11, 2027, marks full applicability. From this point, any new product with digital elements placed on the EU market must meet all remaining CRA requirements in full. Products already on the market before this date stay outside these broader requirements unless they undergo a substantial modification afterward; in that case, they must comply in full from that point on.

CRA Article 14 Reporting Obligations: How They Work

The reporting obligation has three stages, each requiring a different level of detail:

• Within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident: an early warning with basic information, including the affected member states where known.
• Within 72 hours: a more detailed notification, covering an initial assessment of the issue and the measures already taken or planned for users.
• A final report: 14 days after a corrective measure becomes available for a vulnerability, or one month after the 72-hour notification for an incident. It covers severity, impact, root cause, and the corrective measures taken.

You can become aware of a reportable event in several ways: through threat intelligence, a report from an integrator or customer, a security researcher, a government agency, or telemetry data from the product itself. Once you have reasonable confidence that a vulnerability is being actively exploited, or that an incident meets the CRA’s severity criteria, the 24-hour deadline begins.

This is a process that runs under time pressure, potentially more than once. It depends on internal escalation paths that most organizations do not build overnight. Someone has to receive the initial signal, assess whether it meets the CRA’s criteria, and produce a regulator-ready notification within 24 hours. You can test this readiness in advance, for example through a tabletop exercise that simulates a vulnerability report arriving late on a Friday and checks whether your team could realistically get a regulator-ready notification out within the deadline.

CRA Penalties: Fines, Market Exclusion, and Reputational Risk

Meeting the reporting deadline is one thing; what happens if you don’t is another. Article 64 sets out the CRA’s penalty structure on three tiers:

Tier	What it covers	Maximum fine
Highest	Violations of the essential cybersecurity requirements in Annex I, or of the manufacturer obligations under Articles 13 and 14	€15 million or 2.5% of worldwide annual turnover, whichever is higher
Middle	A broader set of obligations, including importer and distributor duties under Articles 19 and 20, and the rules on declaration of conformity and CE marking under Articles 28 and 30	€10 million or 2% of worldwide annual turnover, whichever is higher
Lowest	Supplying incorrect, incomplete, or misleading information to notified bodies or market surveillance authorities	€5 million or 1% of worldwide annual turnover, whichever is higher

Fines are only one part of what is at stake. If a product is found non-compliant, market surveillance authorities can require corrective measures. If those measures aren’t taken, or aren’t sufficient, they can have the product withdrawn from the market or recalled. For a manufacturer, that means a product that has already generated revenue and built a customer base can be pulled from sale entirely, independent of any fine.

There’s a reputational dimension too. The CRA requires you to inform affected users, and where appropriate all users, about a reported vulnerability or incident and the measures they can take. A recall or a public market restriction becomes visible to customers, partners, and the press in a way an internal audit finding never does.

What the CRA Timeline Means for Your Compliance Planning

Fines and market consequences are real, but for most organizations, the more immediate question is logistical: how do you actually get ready in time, for two obligations that run on very different clocks?

If you manufacture important or critical products, conformity assessment isn’t something to arrange shortly before a launch. Accreditation and designation of new notified bodies – organizations that formally assess whether your product meets the CRA’s requirements – typically takes twelve to eighteen months, and the CRA framework for this only opened in June 2026. Article 35 sets a target for member states to ensure a sufficient number of notified bodies by December 11, 2026, a full year before the deadline for full applicability, precisely to prevent this kind of bottleneck. If you wait until 2027 to look for an assessor, you may find yourself queuing behind organizations that started earlier.

Reporting readiness follows a different logic. It doesn’t depend on a scarce external resource like assessment capacity, so you can build it up faster. But it still takes more than a policy document. A working escalation path, a tested submission workflow, and people who know their role in the process all take real preparation time, and that work is due now, not in 2027.

In practice, this means treating reporting readiness and conformity assessment as two separate planning tracks. Reporting readiness is an organizational and process question you can address within months, provided you start early enough: run the tabletop exercise, assign clear ownership for the 24-hour clock, and make sure your team knows the escalation path before they need it. Conformity assessment is constrained by external capacity outside your control, which makes early engagement with a notified body a scheduling decision as much as a compliance one.

Why the CRA Deadlines Aren’t a One-Time Task

The CRA’s timeline is not a single deadline to plan around. It’s a sequence of obligations that started taking effect well before the point most organizations have in mind, with different requirements, different lead times, and different consequences for missing them. Knowing which date applies to which part of your business is where planning starts. The next article in this series looks at what Secure by Design means as an organizational principle, and why building it in now costs less than retrofitting it later.