EU CRA: current status and timeline

01What applies today?

As of 27 October 2026, two parts of the CRA apply: the provisions on notifying conformity assessment bodies (since 11 June 2026) and the Article 14 reporting obligations (since 11 September 2026). Manufacturers report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. No harmonised standard has been cited under the CRA yet, and NANDO lists no notified body for the CRA. Everything else, including the essential requirements, conformity assessment and CE marking, applies from 11 December 2027.

02Timeline

Dates from Article 71 of the Regulation (EUR-Lex). Reporting by open-source software stewards (Article 24(3)) also starts on 11 December 2027 (ENISA).

03Harmonised standards

• The Commission adopted standardisation request M/606 for the CRA by decision C(2025) 618. It covers 41 standards, horizontal and product-specific (vertical), and gives priority to the important and critical product categories in Annexes III and IV (Commission, decision).
• CEN, CENELEC and ETSI accepted the request on 3 April 2025. Horizontal standards are drafted in CEN-CLC/JTC 13 and other technical committees; ETSI's share is handled by the EUSR group under TC CYBER (CEN-CENELEC). The work programme is on STAN4CR.
• The Commission's implementation timeline shows the first standardisation deliverables for the third quarter of 2026 and further deliverables for 30 October 2027 (Commission).
• At the last check, EUR-Lex held no Commission decision citing a harmonised standard under the CRA (EUR-Lex search). A standard gives a presumption of conformity only once its reference is published in the Official Journal (Article 27).

For Class I products, a third-party assessment is needed where no harmonised standard is applied. See the product classes guide.

04Commission acts and guidance

• Implementing Regulation (EU) 2025/2392 (28 November 2025, Official Journal 1 December 2025): technical descriptions of the important and critical product categories (EUR-Lex).
• Delegated Regulation (EU) 2026/881 (11 December 2025, Official Journal 20 April 2026): the conditions under which the CSIRT that first receives a notification may delay passing it on to other CSIRTs on cybersecurity grounds (EUR-Lex).
• Commission guidance C(2026) 5252 (27 July 2026): scope for remote data processing and open-source software, substantial modification, support periods, reporting and risk assessment. It is non-binding; the Commission also publishes an FAQ (Commission).
• Planned: a delegated act on the presumption of conformity between the EUCC certification scheme and the CRA, shown for the fourth quarter of 2026 in the Commission's timeline (Commission).
• SBOM format: Article 13(24) lets the Commission specify the format and elements of the SBOM by implementing act. The Commission's implementation timeline lists no such act (Commission).

05ENISA Single Reporting Platform (SRP)

• ENISA deployed the platform's initial operating capability on 11 September 2026. Manufacturers file their Article 14 reports there (ENISA).
• The CSIRT designated as coordinator that first receives a notification passes it on to the CSIRTs of the other Member States where the product is available; the notification is made available to ENISA at the same time.
• ENISA says it will extend the platform's functions over the coming months. An FAQ, user manuals, tutorial videos, an SRP glossary and a help desk are available.

For deadlines and report contents, see the Article 14 guide.

06Notified bodies

• Chapter IV has applied since 11 June 2026; Member States designate their notifying authorities (Commission).
• The Commission's timeline gives 11 December 2026 for the notification of sufficient conformity assessment bodies across Member States.
• As of 27 October 2026, NANDO shows no active notification under Regulation (EU) 2024/2847 (NANDO).

07Related legislation

• RED: Delegated Regulation (EU) 2026/339 repeals Delegated Regulation 2022/30, which activated the cybersecurity requirements for radio equipment, with effect from 11 December 2027; until then the RED requirements and EN 18031 apply (EUR-Lex, EN 18031 guide).
• NIS2: the CRA defines the CSIRT designated as coordinator, which receives the reports, as the CSIRT designated under Article 12(1) of the NIS2 Directive (EU) 2022/2555, and its definition of "incident" refers to NIS2 (CRA Article 3) (EUR-Lex).

08Change log