Regulationsby GlyphCyber Resilience Act
Enacted European Union · In force Dec 10, 2024 · next deadline Dec 11, 2027 (in 13 months)
Deadlines
Coming up
CRA fully appliesAll remaining obligations, including essential cybersecurity requirements, conformity assessment and CE marking, apply (Art 71(2)). Products placed on the market earlier are covered only if substantially modified (Art 69(2)).
Legacy type-examination certificates expireEU type-examination certificates and approval decisions on cybersecurity requirements under other harmonisation legislation remain valid until this date unless they expire earlier (Art 69(1)).
Report on single reporting platformCommission report assessing the single reporting platform's effectiveness (Art 70(2)).
First CRA evaluationCommission evaluation and review report, then every four years (Art 70(1)).
Already passed
Vulnerability and incident reporting obligations applyArt 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single reporting platform. Also covers products placed on the market before 11 Dec 2027 (Art 69(3)).
Conformity assessment body provisions applyChapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).
CRA enters into forceEntered into force on the twentieth day after publication in the OJ on 20 Nov 2024 (Art 71(1)).
Summaries for reference, not legal advice. Check the official text.
What it does
Sets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.
- Who it applies to
- Manufacturers, importers and distributors of products with digital elements (connected hardware and software, including remote data processing solutions) made available on the EU market. Stricter conformity assessment for 'important' and 'critical' products. Non-commercial open source is largely excluded, with light-touch rules for open-source software stewards.
- Penalties
- Essential requirements and Arts 13-14 obligations: up to EUR 15M or 2.5% of worldwide annual turnover, whichever is higher. Other obligations: up to EUR 10M or 2%. Incorrect or misleading information: up to EUR 5M or 1% (Art 64).
- Enforced by
- National market surveillance authorities; CSIRTs and ENISA (vulnerability and incident reporting via the single reporting platform); European Commission
- Official name
- Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)
- Citation
- OJ L, 2024/2847, 20.11.2024
- Topics
- Cybersecurity, Breach notification
Verified 2026-09-22
Research notes
Status is 'enacted' because the main product obligations do not apply until 11 Dec 2027, although reporting obligations apply from 11 Sep 2026. No proposal to delay CRA dates was confirmed in this research. The Digital Omnibus's single-entry point for incident reporting is designed to build on the CRA single reporting platform.
Related
DORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 monthsEU Consumer Credit Directive 2 (CCD2)Replaces the 2008 Consumer Credit Directive and extends it to buy-now-pay-later and small loans. Creditworthiness assessments must use relevant, accurate data and may not use special category data or social media data. Where the assessment involves automated processing, consumers get a right to human intervention and an explanation.Next: Nov 20 National rules apply · in 24 days
Questions about Cyber Resilience Act
- What are the Cyber Resilience Act compliance deadlines?
- Dec 10, 2024: CRA enters into force. Jun 11, 2026: Conformity assessment body provisions apply. Sep 11, 2026: Vulnerability and incident reporting obligations apply. Dec 11, 2027: CRA fully applies. Jun 11, 2028: Legacy type-examination certificates expire. Sep 11, 2028: Report on single reporting platform. Dec 11, 2030: First CRA evaluation.
- When does Cyber Resilience Act take effect?
- Cyber Resilience Act took effect on Dec 10, 2024. The next milestone is Dec 11, 2027: CRA fully applies.
- Who does Cyber Resilience Act apply to?
- Manufacturers, importers and distributors of products with digital elements (connected hardware and software, including remote data processing solutions) made available on the EU market. Stricter conformity assessment for 'important' and 'critical' products. Non-commercial open source is largely excluded, with light-touch rules for open-source software stewards.
- What are the penalties under Cyber Resilience Act?
- Essential requirements and Arts 13-14 obligations: up to EUR 15M or 2.5% of worldwide annual turnover, whichever is higher. Other obligations: up to EUR 10M or 2%. Incorrect or misleading information: up to EUR 5M or 1% (Art 64).