Three deadlines. One regulation. The clock started today.
The EU Cyber Resilience Act (CRA), published in the Official Journal on November 20, 2024
and in force since December 10, 2024, is running a phased application schedule derived
directly from its published Article 69 timeline. June 11, 2026, today, is the 18-month
mark: EU member states may now formally designate notifying authorities to begin accrediting
Conformity Assessment Bodies (CABs) for third-party cybersecurity audits. That’s the
institutional machinery activating. The compliance deadlines that directly affect
manufacturers and software publishers are what follows from it.
September 11 is the one to calendar now.
That’s when the CRA’s mandatory vulnerability and incident reporting obligations activate –
21 months from the regulation’s December 10, 2024 entry into force. Any manufacturer or
software publisher with products on the EU market that contain digital elements will be
required to report actively exploited vulnerabilities and significant incidents to ENISA. The CRA establishes tiered rapid reporting requirements for actively exploited
vulnerabilities; legal analysts have cited a 24-hour early-warning requirement to ENISA as
part of the tiered structure, though teams should verify the specific hour-count thresholds
against
Article 14 of the regulation’s official text before building that figure into
compliance programs.
Who This Affects
December 11, 2027 is the full compliance deadline, CE marking, Software Bill of Materials
(SBOM), and design-phase security requirements. That’s 36 months from entry into force.
Why it matters. The CRA covers connected hardware and software products with digital
elements. That’s a wide scope. It isn’t limited to obvious cybersecurity products, it
reaches connected consumer devices, enterprise software, and industrial systems. Legal
analysts, including those at Hogan Lovells, interpret the CRA’s coverage as extending to
legacy products already on the market, subject to conditions including continued activity
or modification, though teams should verify this interpretation with their own counsel,
since the source for this reading is dead and the official text governs.
Today’s milestone is the institutional step. Don’t mistake it for the compliance deadline. Its significance is what it starts: the 90-day window before September 11 is now open.
Context. The CRA has been underrepresented in compliance calendars relative to the EU
AI Act, partly because its headline deadline is still 18 months out. But the vulnerability
reporting obligation that activates in September operates independently of the December
2027 full compliance date. Organizations that treat December 2027 as the “CRA deadline”
and haven’t built the September reporting infrastructure are going to find themselves
non-compliant on a legally active obligation three months from now.
Unanswered Questions
- Does the CRA's legacy product inclusion interpretation (Hogan Lovells reading) hold for your specific product category, verify against Article 69 and your counsel's assessment?
- What is the specific hour-count threshold for the early-warning reporting stage under Article 14 for actively exploited vulnerabilities, confirm against official text before operationalizing?
- How many EU member states will complete CAB accreditation before September 11, and what does an enforcement gap between legal obligation and enforcement infrastructure mean for your compliance posture?
What to watch. The real question is whether EU member states will complete CAB
accreditation in time for the September reporting framework to have functioning oversight
infrastructure. If member states lag on notifying authority designation, the enforcement
apparatus won’t be fully operational by September 11, but the legal obligations will be. That gap doesn’t reduce compliance risk; it only reduces the immediate enforcement
probability.
Don’t expect the September deadline to move. It’s structural, not discretionary, it’s
derived directly from the regulation’s own phased application schedule, not from Commission
guidance that can be revised.
The organizations that treat today as a starting gun will be ready in September. The ones
that treat it as a calendar note probably won’t be.