In force since December 2024. Chapter IV (notification of conformity assessment bodies) has applied since 11 June 2026 and Article 14 — manufacturers' reporting of actively exploited vulnerabilities and severe incidents — since 11 September 2026; the Regulation as a whole, including the main obligations on manufacturers, importers and distributors and the reporting obligations of open-source software stewards (Art. 24(3)), applies from 11 December 2027 (Art. 71(2), re-read on EUR-Lex on 14 Oct 2026). The scalar alone is insufficient — read the milestones. last_verified moved from 27 Aug to 14 Oct 2026 on 21 Oct 2026 (audit item 10), the date on which the status above was re-read (docs/AUDIT-2026-10-14.md §1 F), so that it is not earlier than status_as_of; the other fields were last re-read on 27 Aug 2026.
In short: what you need to know
Objective: Horizontal cybersecurity requirements for products with digital elements.
Who it binds: Manufacturer of a product with digital elements
Key dates: Entry into force 10 December 2024 · Application date 11 June 2026 · Application date 11 September 2026 · Application date 11 December 2027+2 more dated events →
Sanction ceiling:not establishedunknown — not established in this build.enforcement →
What does the Cyber Resilience Act do?
Horizontal cybersecurity requirements for products with digital elements.
How it allocates obligations
Product security across the lifecycle.
Regulated actor
Manufacturer of a product with digital elements
Protected party
End user
Territorial reach
Established in the EU · Outside the EU, serving EU users
Entry into force, application and transposition are different events and are kept apart. A date at month precision is shown as a month rather than invented as a day.
23 October 2024AdoptionAdoption
20 November 2024Publication in the Official JournalPublication in the Official Journal
10 December 2024Entry into forceEntry into force
11 June 2026Application dateChapter IV (Articles 35 to 51), on the notification of conformity assessment bodies, applies.
11 September 2026Application dateArticle 14 applies: manufacturers must notify actively exploited vulnerabilities and severe incidents affecting the security of their products with digital elements, through ENISA's single reporting platform. Open-source software stewards' reporting (Art. 24(3)) applies only from 11 December 2027.What it requires: Stand up a coordinated vulnerability disclosure and incident reporting process before this date.
11 December 2027Application dateThe Regulation applies in full (Art. 71(2)): the main obligations on manufacturers, importers and distributors, and the reporting obligations of open-source software stewards under Article 24(3).What it requires: Complete conformity assessment for products with digital elements.
1 rule in the dataset turn on this instrument. They are conditions, not a test: the engine ranks them against what you actually answer, and downgrades rather than excludes where a question is left blank.
Potentially applicable
actor Manufacturer or Manufacturer of a product with digital elements or Connected-product provideractivity Placing connected products on the market or Placing products with digital elements on the market
The Cyber Resilience Act sets horizontal cybersecurity requirements for products with digital elements across their lifecycle. Reporting of actively exploited vulnerabilities and serious incidents begins on 11 September 2026; full application follows on 11 December 2027.
5 provisions recorded. This is what the dataset holds, not the whole instrument — an article that is not here has not been entered, which is a different statement from its not existing.
Article
Heading
Binds
Applies
Art. 13
Obligations of manufacturersWhen placing a product with digital elements on the market, manufacturers must ensure it has been designed, developed and produced in accordance with the essential cybersecurity requirements in Part I of Annex I.
Manufacturer · Manufacturer of a product with digital elements
Applies from 11 December 2027the instrument’s general date; nothing specific to this article is recorded
Art. 14
Reporting obligations of manufacturersManufacturers must notify any actively exploited vulnerability, and severe incidents, simultaneously to the CSIRT designated as coordinator and to ENISA, via the single reporting platform. Applies from 11 September 2026 (Art. 71(2)).
Manufacturer · Manufacturer of a product with digital elements
Applies from 11 September 2026
Art. 16
Establishment of a single reporting platformENISA establishes the single reporting platform for the notifications under Articles 14 and 15, and manages and maintains its day-to-day operations.
not recorded
Applies from 11 December 2027the instrument’s general date; nothing specific to this article is recorded
Art. 24
Obligations of open-source software stewardsStewards must have a documented cybersecurity policy and cooperate with market surveillance authorities. Under Art. 24(3) the Art. 14(1) notification obligation applies to them to the extent they are involved in the development of the product, and Art. 14(3) and (8) where severe incidents affect the network and information systems they provide for development. Applies from 11 December 2027, the general date (Art. 71(2)), not from 11 September 2026.
Manufacturer of a product with digital elements
Applies from 11 December 2027the instrument’s general date; nothing specific to this article is recorded
Art. 35–51 (Chapter IV)
Notification of conformity assessment bodiesThe rules under which Member States notify the bodies that carry out third-party conformity assessment of products with digital elements. Applies from 11 June 2026 (Art. 71(2)), ahead of the rest of the Regulation, so that notified bodies exist before the main obligations apply on 11 December 2027.
Member State
Applies from 11 June 2026
How is the CRA enforced?
No enforcement recorded
This dataset holds no enforcement action under this instrument. That is what the record says; it is not a finding that none has been taken.
Every statement this site makes about CRA, graded by what actually carries it. The grade is derived from the claim type and its sources, never stored, so it cannot drift from what it describes.
The instrument record itself was last verified on 14 October 2026; every claim below carries its own date.
1 Interpretation
Interpretationinterpretation
The EU's directive-based instruments underperform its regulation-based ones badly — the strongest single argument for the regulation-first drafting approach used elsewhere in the rulebook.
1 recorded interaction with other instruments — each with a direction, the provisions that carry it and its own sources. Direction is preserved as recorded: an instrument that amends another is not the same as one amended by it.