CRA

1. 2026-10-17 Medium
   Bundestag adopts CRA implementation law – BSI becomes supervisory authority

   The German Bundestag has adopted the implementation law for the Cyber Resilience Act (CRA), establishing the national legal framework for mandatory cybersecurity requirements for products with …

   New document Action required

2. 2026-09-11 Low
   Vulnerability reporting obligations under CRA come into force in the EU

   As of 11 September 2026, Article 14 of the Cyber Resilience Act (EU Regulation 2024/2847) becomes applicable in the EU, establishing horizontal cybersecurity requirements for products …

   New document Effective 2026-09-11

3. 2026-09-11 Medium
   Meldepflicht für Schwachstellen und Sicherheitsvorfälle startet

   Ab dem 11. September 2026 müssen Hersteller von Produkten mit digitalen Elementen im EU-Binnenmarkt aktiv ausgenutzte Schwachstellen und schwerwiegende Sicherheitsvorfälle melden. Die Meldungen erfolgen EU-weit einheitlich …

   Guidance Action required

4. 2026-09-09 Info
   EU proposes Public Procurement Act consolidating directives and amending regulations

   The European Commission proposes a new Public Procurement Act that consolidates the three 2014 procurement directives (2014/23/EU, 2014/24/EU, and 2014/25/EU) into a single regulation and amends …

   Draft consultation

That is the last 90 days. Sign in to read further back.

1. 2027-03-26 in 137 days EHDS amendments to CRA Articles 13, 31 and 32 apply
2. 2027-12-11 in 397 days The CRA applies in full, including the essential requirements; open-source software stewards' reporting duties start
3. 2030-12-11 in 1493 days Commission review of the CRA due (Article 70(1))
4. 2026-09-11 Article 14 reporting of actively exploited vulnerabilities and severe incidents applies; ENISA launches the Single Reporting Platform
5. 2026-06-11 Rules on notified conformity assessment bodies (Chapter IV) apply
6. 2025-11-28 Commission adopts Implementing Regulation (EU) 2025/2392 describing the important and critical product categories
7. 2024-12-10 The CRA enters into force

1. 2026-09-09
   Public procurement proposal, COM(2026) 590 Draft

   Commission proposal for a regulation on public contracts and concessions that would delete CRA Article 5 (public procurement) and move that rule into its own Article 68. source

   More

   • Not adopted; the European Parliament lists procedure 2026/0265(COD) in its preparatory phase.
2. 2025-10-17
   Regulation (EU) 2024/2847 (as corrected October 2025) ErrataCurrent text

   Corrigendum renumbering the CRA's entry in the Annex to Directive (EU) 2020/1828 (Article 67) from 69 to 72. source

3. 2025-07-02
   Regulation (EU) 2024/2847 (as corrected July 2025) Errata

   Corrigendum to Article 64(10): the exemptions from fines (late early warnings by micro and small manufacturers, open-source stewards) cover paragraphs 2 to 9, not 3 to 9. source

4. 2025-02-11
   Amended by the EHDS, Regulation (EU) 2025/327 Amendment

   The European Health Data Space Regulation amends CRA Articles 13(4), 31(3) and adds Article 32(5a), so EHR systems show CRA conformity through the EHDS procedure. source

   More

   • The changes apply from 26 March 2027.
5. 2024-12-05
   Regulation (EU) 2024/2847 (as corrected December 2024) Errata

   Corrigendum to the title of the Regulation. source

The CRA covers products with digital elements that connect to a device or network, whoever places them on the EU market.

Products

Products with digital elements made available on the market whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1)). source

Excluded

Products under the medical device, in vitro diagnostic and vehicle type-approval regulations, products certified under the aviation regulation, and marine equipment (Article 2(2)-(4)). source

Higher-risk products

Important products (classes I and II, Annex III) and critical products (Annex IV) face stricter conformity assessment; Implementing Regulation (EU) 2025/2392 describes those categories technically. source source

Products already on sale

Products placed on the market before 11 December 2027 are covered only after a substantial modification, but the Article 14 reporting duties apply to them anyway (Article 69(2)-(3)). source

Most products are self-assessed by the manufacturer; important products may need a notified body, and critical products may need a European cybersecurity certificate.

Default route

Internal control (module A), EU-type examination (modules B and C), full quality assurance (module H), or a European cybersecurity certification scheme where available (Article 32(1)). source

Important, class I

Self-assessment only if harmonised standards, common specifications or a certification scheme are applied in full; otherwise module B+C or H (Article 32(2)). source

Important, class II

Module B+C, module H, or a European cybersecurity certificate at assurance level at least "substantial" (Article 32(3)). source

Vulnerability handling

Manufacturers handle vulnerabilities for the support period, which is at least five years unless the product is expected to be in use for less (Article 13(8)). source

Reporting

For an actively exploited vulnerability or a severe incident: early warning within 24 hours, notification within 72 hours, then a final report within 14 days of a fix being available (vulnerabilities) or within one month of the notification (incidents) (Article 14). source source

National market surveillance authorities enforce the CRA and can fine up to EUR 15 million or 2.5% of worldwide turnover.

Market surveillance

Market surveillance authorities check products and can require corrective action, withdrawal or recall (Article 52 and following). source

No fines

Micro and small manufacturers that miss the 24-hour early warning deadline, and open-source software stewards, are not subject to these fines (Article 64(10), as corrected in July 2025). source source

Consumer actions

Consumers can bring representative actions against infringements under Directive (EU) 2020/1828 (Article 65). source

1. Law text Regulation (EU) 2024/2847 (Cyber Resilience Act)
2. Law text Implementing Regulation (EU) 2025/2392 - technical description of important and critical products
3. Law text Delegated Regulation (EU) 2025/1535 - exclusion of certain products under Regulation (EU) No 168/2013
4. Law text Delegated Regulation (EU) 2026/881 - delaying the dissemination of notifications on cybersecurity grounds
5. Guidance Cyber Resilience Act - Reporting obligations (Commission page)

1. RED cyber delegated act

   The earlier cybersecurity requirements for internet-connected radio equipment, repealed from 11 December 2027 so those products fall under the CRA alone.

2. NIS2

   Binds the entities that run services rather than the makers of products; the Digital Omnibus proposal would let a CRA incident report count as NIS2 reporting.

3. EUCC

   A voluntary EU certification scheme for ICT products under the Cybersecurity Act; the CRA accepts European cybersecurity certification schemes as a conformity route where available.

4. EHDS

   Amends the CRA so that electronic health record systems show conformity through the EHDS procedure.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to CRA (RSS)