The Cyber Resilience Act dates: what applies, and from when
The Regulation does not take effect all at once. Four dates, not one — and the one almost nobody has in the calendar is the first that makes a manufacturer liable.
1. Four dates, and why the legislator separated them
Regulation (EU) 2024/2847 has been in force since 10 December 2024, but Art. 71 staggers its application. On 11 June 2026 the chapter on conformity assessment bodies applies: it exists to make notified bodies exist before anyone needs one. On 11 September 2026 Art. 14 applies — reporting. On 11 December 2027 everything else applies.
The sequence is deliberate. Authorities want to see the real traffic of vulnerabilities before demanding product conformity: first how you react, then how you build. It is the reverse of the order nearly every product directive has trained people to expect, and it is why this calendar surprises.
For a manufacturer it means the obligation that lands first is not about the product but about the organisation. None of the four dates moves with company size, sector or turnover.
2. What applies from 11 September 2026 — and what does not
Art. 14 applies in full: early warning within 24 hours, the 72-hour notification, final report, user advisory, and upstream reporting to the component maintainer. Five distinct duties, not one, and they apply from that day to every product with digital elements the manufacturer has on the Union market.
What does not apply yet: the Annex I essential requirements, the technical documentation, the EU declaration of conformity and CE marking. A product without CE marking is not out of order on 11 September 2026 for that reason; it becomes so only if, after that date, it fails to report an exploited vulnerability.
3. Products already on the market get no grace
The date of placing on the market does not enter the calculation. A product shipped in 2021, still supported, whose vulnerability is actively exploited, triggers the duty exactly as one shipped tomorrow. What counts is the moment the manufacturer becomes aware of the exploitation.
It is the consequence most often discovered late, because it inverts intuition: you can be far from product conformity — no marking, no technical file — and still be liable for a report you did not file. Conformity of the object and conformity of the reporting duty run on separate clocks, and the reporting one starts first.
4. What arrives on 11 December 2027
From that date the rest of the Regulation applies: the Annex I Part I essential cybersecurity requirements, the Part II vulnerability-handling process, the Annex VII technical documentation, the conformity assessment along the route your product's class requires, the EU declaration and CE marking.
Fifteen months separate the two dates, and that is not a generous margin: for an important class II or critical product the route goes through a notified body, and a body's calendar is not the manufacturer's to set. Anyone planning to start in 2027 is counting on market capacity that in 2027 will be contested.
5. The dates the Regulation does not fix
Three important things have no date in the text and must be checked country by country. Designating the CSIRT that receives manufacturers' notifications follows national implementation. The operational availability of the single reporting platform depends on ENISA and the related acts. The harmonised standards that make self-assessment workable are published gradually, and not all of them will exist on the date of application.
This is the part of the calendar that ages: the Art. 71 dates are fixed in the text and do not move; these do. A plan that treats them as settled is planning on a certainty that is not there.
6. If you sell in several Member States
The dates are the same across the Union: the Regulation applies directly, with no transposition. What changes from country to country is who receives the notification — the designated CSIRT — and the language you file in.
Which means the calendar is one, and so is the channel: Art. 14(7) sends the notification to the CSIRT of the Member State where you have your main establishment in the Union, and that is one. Credentials, contacts and channel still have to be ready for that single entry point — and none of those steps closes in twenty-four hours.
It is the one point where a deadline identical for everyone produces very different workloads. Worth mapping in advance, not on the day you need it.
This page describes our reading of the legal text and is not legal advice.