The CRA timeline 2024–2027: what to do each quarter

The Cyber Resilience Act feels like a flood of obligations, but laid out on a timeline it's a manageable plan. Regulation (EU) 2024/2847 has three key dates and a clear order of steps. This article is a map: what to do now, what waits until 2027, and where to click for detail. Treat it as an evergreen overview to come back to.

The three key dates

1. 10 December 2024 — entry into force. The regulation is in force, but most obligations have a deferred start.
2. 11 September 2026 — reporting under Article 14. The duty to report actively exploited vulnerabilities and severe incidents (24 h / 72 h / 14 days), and it applies even to products you already sell.
3. 11 December 2027 — full conformity and CE. The essential requirements of Annex I, technical documentation, the declaration of conformity and CE marking for products placed on the market (or substantially modified) after this date.

There is one more interim milestone in between: on 11 June 2026 the provisions on notified bodies take effect (Chapter IV, Art. 71(3)) — so the conformity-assessment system is ready before full conformity applies in December 2027.

First: find out where you belong

Before doing anything, verify whether and how the CRA applies to you. There's no point writing documentation if you're pure SaaS out of scope.

1. Run the scope-checker and read 10 examples of who the CRA concerns.
2. If you're borderline SaaS, see the CRA and SaaS.
3. If you import or resell someone else's product, read importer and distributor duties; if you develop custom software, who the manufacturer is.
4. Determine your product class.

Now until 11 September 2026: processes that don't change

This is the most important batch — the things that apply earliest and don't depend on late standards:

1. Build an SBOM from your current build — 10-minute guide. Learn to read CVE, CVSS, EPSS, KEV.
2. Set up a reporting channel — security.txt and a channel in an hour and a CVD policy to go with it.
3. Register on the ENISA platform (EU Login + CSIRT verification) — Article 14 step by step.
4. Set the support period and roles — who watches and who reports — support period.

Ongoing: monitoring and response

From 11 September 2026 reporting is live. That means having a running cycle:

1. monitor vulnerabilities in components daily (SBOM × databases),
2. on a finding, assess and respond quickly, keeping a risk assessment,
3. publish fixed vulnerabilities via advisories,
4. for customer requests, have inputs and an audit trail ready.

Until 11 December 2027: documentation and CE

This batch has time, but not infinitely:

1. write the technical documentation per Annex VII,
2. track the status of harmonised standards and document against Annex I,
3. prepare the declaration of conformity and CE,
4. check responsibility for open-source components and the CRA vs NIS2 vs GDPR relationship.

How to phase it across quarters

If you have a few months ahead, it helps to split this into quarterly batches instead of one mountain:

1. This quarter: determine scope and class, produce a first SBOM, set up a reporting channel and create an EU Login. These apply earliest and don't depend on standards.
2. Next quarter: get vulnerability monitoring and triage running, write a two-page risk assessment, and set the support period with a justification.
3. Ongoing until 2027: fill in the technical documentation per Annex VII, track the standards status, and keep advisories and the audit trail alive.
4. Close to 11 December 2027: finish the declaration of conformity and CE for versions placed on the market after that date.

You don't have to do everything at once. The order is what matters: processes (SBOM, channel, reporting) first, documentation and CE later — exactly the order the regulation itself requires.

FAQ on the dates

1. Do we need CE by 11 September 2026? No. From 11 September 2026 the Article 14 reporting applies; CE and full conformity only from 11 December 2027.
2. Does reporting also cover products we already sell? Yes — the duty to report actively exploited vulnerabilities also covers products placed on the market earlier.
3. Should we wait for harmonised standards? No. Reporting and the processes (SBOM, channel, monitoring) don't depend on standards; write documentation against Annex I and remap it later.
4. What if we're pure SaaS? You're mostly out of the CRA (recital 12) — but confirm it and address any NIS2.

Why start early, even though 2027 is far off

The biggest trap of the timeline is putting everything off to the end. The first-batch processes (SBOM, reporting channel, platform account) apply earliest and can't be "caught up" overnight — verification of the account by the national CSIRT takes a while and the 24-hour deadline won't wait. You do have until 2027 to finish documentation and CE, but with the processes running from the start, that last batch is just writing down what you already do.

Key point

The CRA becomes manageable once you lay it out on a timeline with a clear order. Three dates: 10 December 2024 entry into force, 11 September 2026 Article 14 reporting (including products you already sell), and 11 December 2027 full conformity and CE. The order of steps mirrors those dates: first find out whether and how the CRA applies to you (scope, class), then build the processes that apply earliest and don't depend on standards — SBOM, reporting channel, ENISA platform account, support period. Run monitoring and response continuously; finish the documentation, declaration of conformity and CE by 2027. The biggest trap is leaving everything to the end: the first-batch processes can't be done overnight and the 24-hour deadline won't wait. Whoever has them running from the start turns the final batch into simply writing down what they already do.

How CRAguard helps

CRAguard covers the "now" and "ongoing" parts of this timeline: it generates and versions the SBOM, monitors vulnerabilities daily with a clear verdict, hosts the reporting channel and advisories, and keeps an audit trail as input for self-assessment and for customers. The dates are clear — 11 September 2026 and 11 December 2027 — and the sooner you have the processes, the more calmly you meet them. Find out whether the CRA applies to you, or join the waitlist.

This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (dates of application, Art. 13, Art. 14, Annexes I, VII, V) and the European Commission's guidance of 27 July 2026.