The CRA timeline: every date that matters, and the one that already passed
Entry into force, 11 June 2026, 11 September 2026 and 11 December 2027, plus the per-product clocks that run from the day you place a product on the market.
Dates below are drawn from Article 71 of Regulation (EU) 2024/2847 and from the manufacturer obligations in Article 13. Check them against the official text before you build a plan on them. This is not legal advice.
Most CRA coverage names two dates. There are four in the Regulation, and the one people miss has already gone by. That matters more than it sounds, because it is the one that governs whether there will be capacity to assess your product when you need it.
The four dates in Article 71
| Date | What starts | Who it binds |
|---|---|---|
| 11 December 2024 | The Regulation enters into force, twenty days after publication in the Official Journal. Nothing is required of manufacturers yet. | Nobody, operationally |
| 11 June 2026 | Chapter IV, Articles 35 to 51, on the notification of conformity assessment bodies. Member States can start designating notified bodies. | Member States and prospective notified bodies |
| 11 September 2026 | Article 14. The reporting obligations for actively exploited vulnerabilities and severe incidents. | Every manufacturer with a product on the EU market |
| 11 December 2027 | Full application. The essential requirements, the technical file, the Declaration of Conformity and the CE mark. | Every manufacturer, importer and distributor |
Read as a set, those are eighteen, twenty-one and thirty-six months from entry into force. The spacing is deliberate: build the assessment infrastructure first, switch on reporting next, and only then require the paperwork that the infrastructure has to check.
Why 11 June 2026 is the date to think about
Before that date no notified body could be designated for the CRA, because the legal basis for designating them was not yet in application. After it, designation can begin, and it is a process rather than a switch.
Now put that against demand. Annex III Class II products need a notified body. So do critical products in Annex IV, and so do Class I products where the manufacturer cannot apply harmonised standards. All of those manufacturers need an assessment completed before 11 December 2027. The bodies that will do that work started being designatable eighteen months before the deadline, and each designation takes time.
If your product is Class II, the sensible reading is that the queue forms in 2026 and clears slowly, and that the manufacturers who book late will pay for it in schedule rather than in fees. This is the one part of CRA planning where being early has a real, measurable payoff, and it is the part that gets the least attention because it does not have a scary number attached to it.
11 September 2026: a process, not a document
From this date, becoming aware that a vulnerability in a product you have on the EU market is being actively exploited starts a clock: an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days of a corrective or mitigating measure being available. A severe incident affecting the security of the product runs the same 24 and 72 hour steps, with a final report within one month of the notification. Filing goes through the ENISA Single Reporting Platform, to the CSIRT designated as coordinator.
The thing that catches people is that this duty is event-driven and the others are not. You cannot prepare for it in the moment, and you cannot prepare for it by writing a document. It needs a named owner, a named deputy who is reachable at the weekend, and platform access that already works.
11 December 2027: the licence to keep selling
From this date a product with digital elements needs a compliant technical file and an EU Declaration of Conformity to carry the CE mark, and without the CE mark it cannot be made available on the EU market. Penalties for the most serious infringements reach 15 million euro or 2.5% of worldwide annual turnover, whichever is higher.
This is a project rather than an obligation you switch on. A first assessment usually surfaces gaps that take months to close, such as a missing disclosure policy or a support period nobody has ever written down.
The clocks that start on your own dates
Three obligations do not run from a date in the Regulation at all. They run from the day you place a particular product on the market, which means every product has its own calendar.
| Clock | Length | Source |
|---|---|---|
| Support period, during which vulnerabilities must be handled under Annex I Part II | At least five years, or the expected use time if the product is expected to be in use for less | Article 13(8) |
| Technical documentation and EU Declaration of Conformity kept available to market surveillance authorities | At least ten years after placing on the market, or the support period, whichever is longer | Article 13(13) |
| Notification to users that the support period has ended | At the end of the support period, where technically feasible | Article 13(19) |
Work that through for a product placed on the EU market on 11 December 2027 with the minimum support period. Vulnerability handling runs to December 2032. The documentation stays available to authorities until at least December 2037. Whoever owns that file today is unlikely to be the person who closes it.
What to do with this, by date
- Now: settle the classification of every product, because it decides whether a notified body is in your future at all.
- Now, if you are Class II or critical: start the conversation with a notified body rather than waiting for the file to be finished. The queue is the constraint, not the paperwork.
- Before 11 September 2026: name a reporting owner and a deputy, get both onto the ENISA platform, confirm your coordinator CSIRT, and run the process once against a pretend incident.
- Through 2027: the technical file, the risk assessment, the SBOM, the declared support period, and the Declaration of Conformity.
- At launch of each product: record the placing-on-market date, because two of the three per-product clocks run from it and nobody remembers it in year eight.
Not sure which of these apply to you? The free applicability check gives you a class and a conformity route in about a minute, and the 24-hour test tells you whether you could actually file in September. Neither needs a signup.