Direct answer: the EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) has been in force since 10 December 2024; since 11 September 2026 manufacturers’ reporting obligations for actively exploited vulnerabilities and severe incidents apply; the main obligations apply from 11 December 2027 (product requirements, CE marking, conformity assessment); Chapter IV on notifying conformity assessment bodies applies from 11 June 2026. For Chinese manufacturers/exporters selling products with digital elements (software, hardware, IoT, embedded systems) in the EU, the work is not “wait until 2027”: inventory products and roles → cybersecurity risk assessment → vulnerability handling and support period → technical documentation/CE → 24h/72h reporting process. This article is based on the European Commission’s official pages and is not legal advice.
This guide is for manufacturers, exporters, importers, distributors and compliance teams selling software, hardware, IoT, embedded systems and products with digital elements in the EU. Data cut-off: 7 November 2026; sources are the European Commission CRA policy page, the CRA legislative summary and the CRA reporting page (accessed 7 November 2026). Official facts, editorial interpretation and items to confirm are kept separate.
CRA in force 10 Dec 2024; reporting from 11 Sep 2026; full application 11 Dec 2027; Chapter IV from 11 Jun 2026. Manufacturers need: risk assessment, Annex I essential requirements, vulnerability handling, support-period end date, technical documentation, conformity assessment, EU declaration, CE marking; 24h early warning, 72h full notification, final report within 14 days after a corrective measure; severe incidents final report within one month after the 72h notification. Importers/distributors verify CE/declaration/documentation/support period; penalties are national, with micro/small enterprises exempt from 24h fines.
Timeline: reporting in 2026, full application in 2027
The CRA entered into force on 10 December 2024; Chapter IV on the notification of conformity assessment bodies applies from 11 June 2026; Article 14 reporting obligations apply from 11 September 2026 (manufacturers report actively exploited vulnerabilities and severe incidents), with ENISA’s CRA Single Reporting Platform (SRP) operational the same day; full application from 11 December 2027 (main product obligations, CE marking, conformity assessment, market surveillance). The Commission published practical guidance for manufacturers/developers/businesses on 27 July 2026. CRA obligations apply to products with digital elements made available on the EU market, including products placed on the market before 11 December 2027 (per the Commission summary), so “legacy products” are not entirely out of scope.
| Date | Event | What it means |
|---|---|---|
| 10 Dec 2024 | CRA enters into force | Regulation live; preparation period begins |
| 11 Jun 2026 | Chapter IV applies | Notified-body notification mechanism starts |
| 11 Sep 2026 | Article 14 reporting applies | Exploited vulnerabilities/severe incidents must be reported; SRP live |
| 11 Dec 2027 | Full application | Product obligations/CE/conformity/market surveillance enforced |
| 27 Jul 2026 | Commission practical guidance | Official implementation guidance (not the legal text) |
Sources: European Commission CRA policy page, CRA legislative summary and CRA reporting page (accessed 7 November 2026). Dates follow the official pages; specific application/transition details follow Regulation (EU) 2024/2847, implementing/delegated acts and Commission guidance.
Who is in scope: products and roles
The CRA covers “products with digital elements”, including software, hardware, IoT, embedded systems and their remote data processing; it applies to products placed on/made available on the EU market, whether paid or free, regardless of where they are made. Roles: manufacturer (places the product on the market under its name/trademark), authorised representative (EU-established, written mandate), importer (places a product bearing a non-EU manufacturer’s name/trademark on the EU market), distributor (supply chain, makes the product available without affecting its properties), open-source software steward (partial obligations; reporting from 11 December 2027). Manufacturers carry the main obligations; importers/distributors have verification and cooperation duties.
| Role | Core obligations | Check first |
|---|---|---|
| Manufacturer | Risk assessment, Annex I essential requirements, vulnerability handling, technical documentation, conformity assessment, EU declaration, CE, support period, reporting | Product class/conformity route |
| Authorised representative | EU representative; keep/provide documentation; cooperate with authorities | Mandate scope/duration |
| Importer | Verify CE/declaration/technical documentation/contact details/support period; act on non-compliance/vulnerabilities | Manufacturer compliance evidence |
| Distributor | Verify CE/declaration/contact details/support period; act on non-compliance | Product marking/documentation |
| Open-source steward | Partial obligations; reporting from 11 Dec 2027; not subject to CRA fines | Whether it qualifies as a steward |
Sources: European Commission CRA legislative summary (accessed 7 November 2026). This is an editorial summary; role determination, the open-source steward definition and importer/distributor obligations follow Regulation (EU) 2024/2847 and Commission guidance.
Manufacturer obligations: risk, design, vulnerabilities, documentation, CE
Before placing the product on the market, the manufacturer performs a cybersecurity risk assessment and implements the Annex I essential cybersecurity requirements across planning, design, development, production, delivery and maintenance; if it integrates third-party components, it must exercise due diligence that they do not compromise security. Technical documentation must include the risk assessment, standards/technical measures and compliance evidence, and be available to market surveillance authorities. Before placing on the market, the manufacturer completes conformity assessment (most products can self-assess; some “important/critical” products need a notified body), signs the EU declaration of conformity and affixes CE marking. It must determine a support period and clearly state its end date (month/year) at purchase. Vulnerability handling runs through the support period: identify, fix, disclose, update.
| Obligation | Key point | Evidence/deliverable |
|---|---|---|
| Risk assessment | Planning to maintenance; third-party due diligence | Risk record, technical documentation |
| Essential requirements | Annex I: secure design/defaults/access control/encryption/integrity etc. | Design docs, test/standard mapping |
| Vulnerability handling | Identify/fix/disclose/update during support period | PSIRT/vulnerability process, SBOM, update records |
| Technical documentation | Risk assessment, standards/measures, compliance evidence | Documentation pack for authorities |
| Conformity assessment | Self-assessment or notified body (by class) | Assessment record, test reports |
| CE/declaration | EU declaration of conformity, CE marking, contact details | Label/packaging/instructions |
| Support period | End date (month/year) at purchase | Instructions/contract/product page |
Sources: European Commission CRA legislative summary (accessed 7 November 2026). This is an editorial summary; Annex I requirements, conformity routes and technical documentation content follow Regulation (EU) 2024/2847, harmonised standards and Commission guidance.
Reporting: 24h, 72h, 14 days, one month
From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security through ENISA’s CRA Single Reporting Platform (SRP): an early warning within 24 hours; a full notification within 72 hours; for actively exploited vulnerabilities, a final report no later than 14 days after a corrective/mitigating measure is available; for severe incidents, a final report within one month after the 72-hour notification. Reports go to the CSIRT of the Member State where the manufacturer has its main establishment and (unless particularly excepted) to ENISA; one report via the SRP. Open-source stewards’ reporting obligations start 11 December 2027. Micro/small manufacturers may not be fined for missing the 24-hour deadline; open-source stewards are not subject to CRA fines.
| Stage | Deadline | Content |
|---|---|---|
| Early warning | 24 hours after awareness | Initial information/suspected exploitation |
| Full notification | 72 hours | Vulnerability/incident details, impact, measures |
| Final report (exploited vulnerability) | ≤14 days after corrective/mitigating measure | Root cause, fix, impact |
| Final report (severe incident) | Within one month after 72h notification | Incident, impact, remediation |
Sources: European Commission CRA reporting page and CRA legislative summary (accessed 7 November 2026). Reporting scope/format, SRP operational details and CSIRT/ENISA division follow the official pages and SRP documentation; this is not legal advice.
Important/critical products and conformity routes
Most products (e.g. household appliances, computer games, mobile applications) can use self-assessment; products classified as “important” or “critical” (Annex III/IV) may require third-party assessment by a notified body. The important/critical categories are refined through delegated/implementing acts; the CRA empowers the Commission to update the lists. Manufacturers first determine whether the product is default, important or critical, then choose the conformity route; using harmonised standards gives a presumption of conformity, but standards are still being developed/updated. Importers/distributors verify CE, the EU declaration, technical documentation, contact details and support period; they act when they find non-compliance or exploited vulnerabilities.
| Product class | Conformity | Check first |
|---|---|---|
| Default (most products) | Self-assessment | Annex I/technical documentation |
| Important (Annex III) | Self-assessment/notified body by category | Delegated/implementing act lists |
| Critical (Annex IV) | Usually notified body | Lists/standards/certification |
| Open-source steward | Partial obligations/reporting from 11 Dec 2027 | Steward definition |
Sources: European Commission CRA policy page/legislative summary (accessed 7 November 2026). Category lists, conformity routes and harmonised-standard status follow Regulation (EU) 2024/2847, delegated/implementing acts and Commission guidance; this article does not make a legal determination.
Compliance checklist
A practical order: product inventory → roles/classification → risk assessment → design/vulnerability handling → documentation/CE → reporting/drills → contracts/supply chain. First list products (model, software version, whether they contain digital elements, remote data processing) and determine manufacturer/importer/distributor/authorised representative; then do an Annex I gap assessment, build PSIRT/vulnerability handling/SBOM/update capability, set the support period and end date; prepare technical documentation, EU declaration and CE label; connect the 24h/72h/14-day/one-month reporting process to the SRP and run a drill; finally write CRA requirements into supplier/customer contracts and change management.
| Step | Action | Output |
|---|---|---|
| 1 Inventory | Products/models/software versions/remote processing | Product list, scope |
| 2 Roles | Manufacturer/importer/distributor/authorised representative/steward | Role matrix, owners |
| 3 Classify | Default/important/critical; conformity route | Classification, assessment plan |
| 4 Risk | Annex I gap assessment, third-party due diligence | Risk assessment, remediation list |
| 5 Vulnerabilities | PSIRT, SBOM, disclosure, updates, support period | Vulnerability process, support-period statement |
| 6 Docs/CE | Technical documentation, EU declaration, CE, contact details | Compliance pack, label |
| 7 Reporting | SRP account, 24h/72h/14-day/one-month SOP, drill | Reporting SOP, drill record |
| 8 Contracts | Supplier/customer/importer clauses, change management | Contract terms, audit rights |
Sources: European Commission CRA policy/summary/reporting pages (accessed 7 November 2026). This is an editorial implementation checklist, not an official compliance template; specific documentation/testing/assessment requirements follow the regulation, harmonised standards and notified-body advice.
FAQ
Is the CRA in force now?
In force since 10 December 2024; reporting obligations since 11 September 2026; full application from 11 December 2027; Chapter IV from 11 June 2026.
Do reporting obligations apply now?
Yes. Since 11 September 2026, manufacturers report actively exploited vulnerabilities and severe incidents via ENISA’s SRP: 24h early warning, 72h full notification, final report within 14 days after a corrective measure (severe incidents: within one month after the 72h notification).
Which products are in scope?
Products with digital elements: software, hardware, IoT, embedded systems and remote data processing; applies when made available on the EU market, paid or free, regardless of manufacturing location. Legacy products may also be covered — do not assume “only new products after 2027”.
Do most products need a notified body?
Most can self-assess; important/critical categories (Annex III/IV) may need a notified body. Determine the class first, then check delegated/implementing acts and harmonised standards.
How long should the support period be?
The CRA requires the manufacturer to determine a support period and clearly state its end date (month/year) at purchase; vulnerabilities must be handled during it. The regulation does not set a single number; the manufacturer decides by product/risk/contract.
What do importers/distributors do?
Verify CE, EU declaration of conformity, technical documentation, manufacturer/importer contact details and support period; act on non-compliance or exploited vulnerabilities and cooperate with authorities.
What are the penalties?
Penalties are set by Member States in national law; the Commission summary notes that micro/small manufacturers may not be fined for missing the 24h reporting deadline, and open-source stewards are not subject to CRA fines. Specific amounts/procedures depend on national law.
What about open source?
The CRA has a special approach: open-source software stewards have partial obligations and reporting from 11 December 2027, and are not subject to CRA fines; companies integrating open source commercially still need third-party due diligence.
Research method and limitations
This article separates “official facts” from “editorial interpretation”: CRA entry/application dates, 24h/72h/14-day/one-month reporting, the SRP, support period, CE/conformity, importer/distributor obligations and the micro/small/open-source penalty treatment come from the European Commission CRA policy page, CRA legislative summary and CRA reporting page (accessed 7 November 2026). The compliance checklist is editorial implementation advice, not an official template.
Eight limitations: (1) this is not legal advice; application depends on Regulation (EU) 2024/2847, delegated/implementing acts, harmonised standards and national law; (2) the important/critical product lists, conformity routes and harmonised-standard status are still evolving; (3) national penalty amounts/procedures are not harmonised and are not listed here; (4) the open-source steward definition/boundary needs official guidance; (5) the support-period length is manufacturer-determined and no single number is given; (6) reporting scope/format/SRP operational details follow ENISA/CSIRT documentation; (7) cross-links with NIS2/DORA/Radio Equipment Directive are not covered; (8) policies/guidance may update — recheck the official pages before publishing. This is not legal advice.
Sources and basis
- European Commission, Cyber Resilience Act policy page: digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act. CRA in force 10 December 2024; full application 11 December 2027; reporting 11 September 2026; CE/notified bodies/market surveillance; 27 July 2026 practical guidance. Accessed 7 November 2026.
- European Commission, CRA legislative summary: digital-strategy.ec.europa.eu/en/policies/cra-summary. Manufacturer/importer/distributor/authorised representative/open-source steward obligations; risk assessment/Annex I/technical documentation/CE/support period; national penalties; micro/small/open-source penalty treatment. Accessed 7 November 2026.
- European Commission, CRA reporting obligations: digital-strategy.ec.europa.eu/en/policies/cra-reporting. Reporting from 11 September 2026; 24h/72h/14-day/one-month; ENISA SRP; open-source stewards from 11 December 2027. Accessed 7 November 2026.
Data cut-off 7 November 2026; based on official pages; not legal advice; compliance depends on the regulation, implementing/delegated acts, harmonised standards and national law.