Updated: 30 March, 2026
18 March, 2026
By when do you need to comply with the Cyber Resilience Act (CRA)? The short answer is that the main date is 11 December 2027, but that is not the first deadline that matters. Some obligations start earlier, especially the reporting obligations that apply from 11 September 2026.
That is why the CRA should not be seen as one deadline at the end of 2027. It is a phased timeline, and the right date depends on which obligation you are looking at.
In this article, we will break down the key dates, explain what needs to be ready by each one, and show why waiting until 2027 can be a mistake.
Key takeaways
- The CRA does not have just one compliance deadline, the timeline is phased.
- 11 September 2026 matters because reporting obligations start to apply then.
- 11 December 2027 is the main date when the CRA generally applies in full.
- Waiting until 2027 is risky because reporting processes, documentation, and compliance work take time to build.
- The practical impact of the CRA timeline depends on your role, your product, and what compliance work is required.
The short answer: the Cyber Resilience Act has more than one date that matters
If you are asking when you need to comply with the Cyber Resilience Act, the short answer is that there is not just one deadline.
The CRA generally applies from 11 December 2027. But that is not the first date that matters. Some obligations start earlier.
In practice, the CRA works on a phased timeline. For most companies, 11 December 2027 is the main compliance date. But 11 September 2026 already matters because the reporting obligations in Article 14 start to apply then. 11 June 2026 also matters because the rules on notifying conformity assessment bodies start to apply.
So the clearest answer is this:
- 10 December 2024: the CRA entered into force.
- 11 June 2026: rules on notifying conformity assessment bodies start to apply.
- 11 September 2026: Article 14 reporting obligations start to apply.
- 11 December 2027: the CRA generally applies in full.
What exactly needs to be ready by September 2026?
By 11 September 2026, companies do not need full CRA compliance yet. But they do need to be ready for the reporting obligations in Article 14.
In simple terms, manufacturers need to be able to detect, assess, and report two things:
- Actively exploited vulnerabilities
- Severe incidents affecting the security of the product
This is important because September 2026 is not just a formal date on a timeline. It creates a real operational requirement.
By that point, companies should have:
- a way to identify reportable vulnerabilities and incidents
- clear internal ownership for reporting
- a process for collecting the right facts quickly
- an escalation path for security, product, and legal teams
- the ability to submit reports within the required deadlines
Those deadlines are short. In some cases, the first notification must happen within 24 hours. That means waiting until a problem happens is too late.
So, while September 2026 is not the deadline for full CRA readiness, it is the deadline for having a working reporting process in place. For many organizations, that will require preparation well before then.
Want to learn how to prepare for CRA? Check out our CRA preparation guide.
What needs to be ready by December 2027?
By 11 December 2027, the CRA applies in full.
This is the main deadline for broader compliance. By then, companies should not only be able to report vulnerabilities and incidents. They should also be ready to meet the wider product security requirements in the Regulation.
In practice, that means having the right foundations in place across the product lifecycle. This can include:
- secure by design and by default practices
- risk assessment and risk reduction measures
- technical documentation
- vulnerability handling processes
- clear security information for users
- support for security updates where required
- the right conformity assessment route for the product
Why is waiting until 2027 risky for Cyber Resilience Act compliance?
On paper, 11 December 2027 may look like the main deadline. In practice, waiting that long is risky.
It can also increase your exposure if something goes wrong. If you want to understand the potential consequences in more detail, read our article on CRA fines.
CRA compliance is not a single task. It usually means reviewing products, clarifying scope, assigning responsibilities, building processes, updating documentation, and fixing gaps. That takes time.
Many companies will also need to answer basic questions before they can act. Which products are in scope? Who is the manufacturer? Which teams own reporting, documentation, and ongoing security support? Those questions can slow things down if they are left too late.
The September 2026 reporting obligations add even more pressure. If a company needs to report within very short deadlines, it cannot build that process at the last minute.
Some organizations may also depend on external parties, such as testing labs, assessors, suppliers, or notified bodies. If demand increases closer to 2027, delays could become more likely.
So while full CRA application is in December 2027, the safer approach is to treat compliance as a staged preparation effort, not a last minute project.
A practical Cyber Resilience Act timeline: what to do now, in 2026, and before 2027
The easiest way to approach the CRA is to break the work into stages.
Now
Start by identifying which products are in scope. Then clarify your role for each product and review where the biggest gaps are. This gives you a realistic view of what needs to change.
Before September 2026
Focus on reporting readiness. Make sure you can identify reportable vulnerabilities and severe incidents, gather the right information quickly, and escalate decisions to the right people. If your teams cannot do that under tight deadlines, this is where to start.
Before December 2027
Use the extra time to complete the wider compliance work. This may include strengthening secure development practices, updating documentation, improving vulnerability handling, preparing user information, and following the right conformity assessment path where needed.
This staged approach will be more effective than treating the CRA as one large deadline at the end of 2027.
Want a tool to help you implement this staged plan? SAMMY helps with CRA gap analysis, planning and reporting.
Does the deadline differ depending on your role or product?
The main CRA dates stay the same, but their practical impact can differ depending on your role and your product.
That starts with understanding whether the CRA applies to you in the first place. If you are still working that out, read our article on who needs to comply with the Cyber Resilience Act.
For manufacturers, the pressure usually comes first. They are the main party responsible for meeting the core product requirements and, from 11 September 2026, the reporting obligations.
For importers and distributors, the timeline is linked to the same Regulation, but their responsibilities are different. In practice, this often means less direct compliance work than for manufacturers, but still a need to understand which products are in scope and whether the right steps have been taken.
The type of product also matters. Some products may be easier to assess and document. Others may need more work, more evidence, or a more demanding conformity assessment route.
So the legal dates do not change, but the amount of work needed before those dates can vary a lot. That is why companies should not only ask “when does the CRA apply?” but also “what will compliance involve for our role and our products?”
Conclusion
So, by when do you need to comply with the CRA?
The clearest answer is that there is more than one date that matters. 11 September 2026 is important for reporting obligations, while 11 December 2027 is the main date for broader CRA compliance.
That is why the best approach is not to treat the CRA as a last minute deadline. It is better to treat it as a phased compliance effort and start preparing early.
Are you ready for CRA?
With the CRA Framework in SAMMY, you can assess CRA compliance for your different products. The questions and quality criteria give you a complete checklist of everything that is required by CRA. SAMMY also makes it easy to compare products groups, manage compliance roadmaps and collaborate with team members.
Find out more about the SAMMY tool for CRA assessments.
Official resources
