CRA Timeline: Three Key Dates and Existing Models

The CRA applies in phases. Knowing when each phase starts helps companies decide what to prepare first, and early planning matters even more in industries with long product life cycles.

📅 Three key CRA dates

⏰ 11 June 2026 | Provisions on notified bodies start to apply
The provisions on notified bodies start to apply. Companies can find out in advance what resources and procedures product conformity assessment will require.
⏰ 11 September 2026 | Reporting obligations for vulnerabilities and cybersecurity incidents start to apply
When an actively exploited vulnerability is found in a product, or a severe incident having an impact on the security of the product occurs, it must be reported as required. Products placed on the market before 11 December 2027 are also subject to the reporting obligations.
⏰ 11 December 2027 | The CRA applies in full
Products must meet the CRA's essential cybersecurity requirements and complete the conformity assessment and CE marking procedures.
⚠️ Important: the transitional arrangements are determined per individual product, not per product model.
In other words, individual units of the same model placed on the EU market (first made available on the EU market) on or after 11 December 2027 must meet the full CRA requirements.

👉 Do any of these situations apply to your company?

🏭 Industrial PCs: Product life cycles are long, with supply and use often running for more than five years. If a model launched in 2022 is still shipping in 2028, units newly placed on the EU market must comply with the CRA; for units already in operation at customer sites, an actively exploited vulnerability must still be reported as required.
🌐 Networking equipment: Firmware is updated continuously. If a functionality update changes the product's original intended purpose or affects its compliance, it may constitute a substantial modification.
🔋 Energy storage systems: Project delivery lead times are long, so check which applicability phase the actual delivery date falls into.

📋 Recommended approach

Start by identifying models that will still be in mass production or shipping after the end of 2027, check their product versions, SBOMs, vulnerability management and test records, and plan your CRA conformity preparations early.

👉 Want to confirm which of your models need to be prepared first?

Get in touch with Anselm (安盛資訊). We help companies set up traceability for product versions, SBOMs, vulnerabilities and test records.

📩 Contact Anselm: sales@anselm.com.tw

Further reading: EU CRA series | Previous article: What Is the EU CRA? Who Counts as a Manufacturer and Which Products Are in Scope? | Next article: EU CRA Product Classification and CE Marking: Choosing the Conformity Assessment Route

This article is for general information only and does not constitute legal advice.