Regulation (EU) 2024/2847 applies in phases. The dates below come from Article 71 (Entry into force and application).
The Regulation is adopted by the European Parliament and the Council under the ordinary legislative procedure.
Published in OJ L of 20 November 2024 as Regulation (EU) 2024/2847.
Per Article 71(1), the Regulation enters into force on the twentieth day following its publication. From this date, the legal text exists; most obligations are not yet directly applicable.
The Commission adopts Implementing Regulation (EU) 2025/2392, describing each category of important products (Annex III, classes I and II) and critical products (Annex IV). It does not change the lists; it says what falls inside each category. Article 7(4) required it by 11 December 2025.
Article 7(4); Implementing Regulation (EU) 2025/2392.
The Commission adopts Delegated Regulation (EU) 2026/881, setting the cybersecurity-related grounds on which the CSIRT that receives an Article 14 notification may delay disseminating it to other CSIRTs. Article 14(9) required it by 11 December 2025.
Article 14(9); Delegated Regulation (EU) 2026/881.
Notification rules for conformity assessment bodies start to apply. Member States must designate notifying authorities and start to notify bodies so that, at full application, accredited conformity assessment capacity is available.
Article 71(2), second subparagraph.
Manufacturers must report actively exploited vulnerabilities and severe incidents simultaneously to the CSIRT coordinator and ENISA via the single reporting platform (Article 16). Timelines: 24-hour early warning, 72-hour notification, 14-day final report for vulnerabilities; 24h/72h/1-month for severe incidents.
Article 71(2), second subparagraph.
Member States shall strive to ensure that the Union has a sufficient number of notified bodies to carry out conformity assessments, so that manufacturers who need a third-party assessment are not left waiting at full application.
All remaining obligations apply. Products with digital elements placed on the Union market must comply with the essential cybersecurity requirements (Annex I), carry the CE marking, and be accompanied by an EU declaration of conformity. Penalties (Article 64) become enforceable.
Article 71(2), first subparagraph.
EU type-examination certificates and approval decisions on cybersecurity requirements, issued under other Union harmonisation legislation, remain valid until this date unless they expire earlier or that legislation says otherwise.
The Commission reports to the European Parliament and the Council, after consulting ENISA and the CSIRTs network, on how well the single reporting platform works and on the use of the grounds for delaying dissemination.
The Commission submits its first report on the evaluation and review of the Cyber Resilience Act, and one every four years after that. The reports are public.
A product placed on the market before 11 December 2027 is subject to the Regulation's requirements only if, from that date, it undergoes a substantial modification. The exception is reporting: the Article 14 obligations apply to every product in scope, including those placed on the market before 11 December 2027. A manufacturer therefore has to report actively exploited vulnerabilities and severe incidents in products it shipped years ago, from 11 September 2026.
Article 69(2) and (3). For what the reporting clock requires in practice, see CRA Article 14: the 24h/72h/14-day reporting clock.
| Article / Chapter | Applies from | Reference |
|---|---|---|
| Article 14 (reporting obligations of manufacturers) | 11 September 2026 | Article 71(2) |
| Chapter IV — Articles 35 to 51 (notification of conformity assessment bodies) | 11 June 2026 | Article 71(2) |
| All other articles, annexes, and the essential cybersecurity requirements | 11 December 2027 | Article 71(2) |
The dates above are the application dates set by the Regulation itself. Where the date falls on a weekend or non-working day, EU practice still treats the stated date as the effective date — the regulation does not provide a working-day shift. Verify against the OJ before relying on a specific calendar day.