The Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") does not start on one day. It was published in the Official Journal on 20 November 2024, and its duties switch on in stages until 2028. For a small company selling software or devices, two dates matter most: 11 September 2026 (reporting, already in force) and 11 December 2027 (everything else).
All dates at a glance
| Date | What happens | Legal basis |
|---|---|---|
| 20 November 2024 | Published in the Official Journal (OJ L 2024/2847) | - |
| 10 December 2024 | Entry into force (20th day after publication) | Art. 71(1) |
| 11 June 2026 | Rules on conformity assessment bodies (notified bodies) apply | Art. 71(2), Chapter IV (Art. 35-51) |
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents applies | Art. 71(2), Art. 14 |
| 11 December 2027 | Full application: essential requirements, technical documentation, conformity assessment, CE marking, fines | Art. 71(2) |
| 11 June 2028 | End of validity for EU type-examination certificates and approvals issued for cybersecurity under other EU harmonisation law, unless they expire earlier | Art. 69(1) |
11 September 2026: reporting (already in force)
Article 14 applies from 11 September 2026 (Art. 71(2)). If you become aware of an actively exploited vulnerability in your product, you send an early warning within 24 hours, a notification within 72 hours and a final report no later than 14 days after a fix or mitigation is available. For a severe incident the final report is due within one month of the notification (Art. 14(2) and 14(4)). You submit via ENISA's Single Reporting Platform.
Two points people miss:
- Old products count. Article 14 applies to all in-scope products placed on the market before 11 December 2027 (Art. 69(3)). The app you released in 2022 is covered today.
- No size exemption. A one-person company has the same duty to report. Micro and small companies only cannot be fined for missing the 24-hour early warning (Art. 64(10)(a)).
The full procedure is in our guide to CRA 24-hour reporting.
11 December 2027: full application
From this date the rest of the Regulation applies (Art. 71(2)). For every product you place on the market from then on, you need:
- the essential cybersecurity requirements in Annex I - both for the product and for how you handle vulnerabilities;
- a support period of at least five years, shorter only if the product is expected to be used for less, with the end date (at least month and year) stated at the time of purchase (Art. 13(8) and 13(19));
- technical documentation under Annex VII, including an SBOM; micro and small companies may use a simplified form (Art. 33(5));
- a conformity assessment, an EU declaration of conformity and the CE marking.
The fine regime in Article 64 is not among the provisions that apply early (Art. 71(2)), so it applies from this date.
What about products already on the market? Products placed on the market before 11 December 2027 are subject to these requirements only if they are substantially modified from that date (Art. 69(2)). A substantial modification is a change that affects the product's compliance with the essential cybersecurity requirements (Art. 3(30)). Whether your next release is one depends on what it changes - so do not plan on "grandfathering" a product that you keep developing.
Details: CRA SBOM and technical documentation.
What to do in which quarter
A realistic plan for a micro company with one or two products. The order matters more than the exact months.
Q4 2026 (now) - be ready to report
- Register at least two people on ENISA's Single Reporting Platform.
- Publish a vulnerability contact, for example a
security.txtfile (RFC 9116), and a short coordinated vulnerability disclosure policy. - Generate an SBOM for your current release, so you can tell within hours if an exploited CVE affects you.
- Prepare draft templates for the 24-hour and 72-hour reports.
Q1 2027 - know your category and gaps
- Confirm the product is in scope (scope check).
- Check whether it is an important (Annex III) or critical (Annex IV) product. Most apps and plugins are not, and can use self-assessment.
- Compare your product and processes against Annex I and list the gaps.
Q2 2027 - fix and decide support
- Close the biggest gaps: secure defaults, update mechanism, vulnerability handling.
- Decide the support period (normally at least five years) and where you will show its end date.
- Make SBOM generation part of every release.
Q3 2027 - write the file
- Assemble the technical documentation (Annex VII), including the risk assessment and SBOM.
- If you are an important product without harmonised standards, or a critical product, book a notified body early.
Q4 2027 - sign and mark
- Run the conformity assessment, sign the EU declaration of conformity, apply the CE marking.
- Everything in place before 11 December 2027 for products you place on the market from that day.
What is still open
Harmonised standards that would give a "presumption of conformity" are being prepared. Their publication dates: no data as of October 2026 - plan without them. The Commission published guidance on 27 July 2026 with practical examples on scope, support periods and reporting; it is not binding but shows how the Commission reads the Regulation.
Not sure where you stand?
Take the free "Does the CRA apply to me and what must I do by December 2027" check: 8 questions, about 3 minutes. You get your result on screen and a checklist with dates by e-mail. Take the free check
If the CRA applies to you, Earlybell does the recurring part for you every week: SBOM with every release, a daily check of your dependencies, ready-to-send drafts of the 24-hour and 72-hour reports, and an up-to-date disclosure policy and security.txt - and keeps your technical documentation current for 11 December 2027. 49 EUR per product per month.
This article is based on Regulation (EU) 2024/2847 (Cyber Resilience Act) and on information published by the European Commission. It is not legal advice. Article numbers refer to that Regulation.