EU Cyber Resilience Act: Dates, Scope, Fines

The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, sets mandatory cybersecurity requirements for products with digital elements sold in the EU, from design through the support period. This guide is for compliance staff, research-software teams and technology-transfer offices who need to know whether the Act applies, which dates matter and what the penalties are. Status statements below are as described in the Official Journal text and on the European Commission’s CRA pages on 2026-11-11.

What it is and who runs it

The CRA was adopted on 23 October 2024 and published in the Official Journal on 20 November 2024, with Article 114 TFEU as its legal basis. It entered into force on 10 December 2024 (Article 71(1): the twentieth day after publication). It is an EU regulation, so it applies directly in every Member State without national transposition. National market surveillance authorities enforce it, and a CE marking is how a manufacturer shows a product complies. The Commission describes it as complementing the NIS2 framework, which regulates the security of organisations rather than products.

Scope: what counts as a product with digital elements

Article 3(1) defines a product with digital elements as a software or hardware product and its remote data processing solutions, including components placed on the market separately. Article 2(1) applies the Act to such products made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.

Recitals set out products governed by other regimes instead: medical devices under Regulations (EU) 2017/745 and 2017/746 (recital 25), vehicles under Regulation (EU) 2019/2144 and aviation under Regulation (EU) 2018/1139 (recital 27), and products for national security or defence (recital 26). For the medical-device side, see our guide to FDA premarket cybersecurity for medical devices for the US analogue.

Open-source and research software

Only open-source software supplied in the course of a commercial activity falls within scope (recitals 17-18). Recital 19 creates a light-touch regime for open-source software stewards. A research group that publishes code under an open-source licence without a commercial activity is therefore not automatically a manufacturer; a spin-out that sells a connected product built on that code can be.

What it requires

Manufacturers must meet the essential cybersecurity requirements in Annex I, handle vulnerabilities for the product’s support period, and document the work in technical documentation (Annex VII). Two requirements are easy to overlook:

Support period (Article 13(8)). At least five years. If the product’s expected use time is shorter, the support period equals the expected use time. The basis must be recorded in the technical documentation.
Substantial modification. A substantial modification of a product triggers a new conformity assessment (recitals 38-41).

The CE marking must be affixed visibly, legibly and indelibly (recital 36).

Compliance steps

Decide whether the product is in scope using Articles 2 and 3 and the exclusions above.
Identify the product class (default, important Class I, important Class II or critical under Annex IV), because it determines the conformity route.
Meet the Annex I requirements and record them in technical documentation, including the basis for the support period.
Complete the conformity assessment by the route in Article 32 (table below).
Affix the CE marking and keep reporting processes ready for Article 14 notifications.
Re-assess after substantial modifications.

Conformity routes by product class (Article 32)

Product category	Routes allowed under Article 32
General (default) products	Module A, B+C, H, or a European cybersecurity certification scheme
Important products, Class I	B+C or H if harmonised standards, common specifications or schemes were not applied or do not exist
Important products, Class II	B+C, H, or a certification scheme at assurance level at least substantial
Critical products (Annex IV)	A European cybersecurity certification scheme under Article 8(1); otherwise the Class II procedures
Open-source products listed in Annex III	The Article 32(1) routes are allowed if the technical documentation is made public

Typical timeline phases

Article 71 staggers application in three milestones. Per Article 71(2) and the Commission’s pages as read on 2026-11-11:

Milestone	What starts
11 June 2026	Chapter IV (Articles 35-51) on notified bodies applies
11 September 2026	Article 14 reporting obligations apply
11 December 2027	The Regulation applies in general

Reporting under Article 14

For actively exploited vulnerabilities and severe incidents, manufacturers submit an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report. The final report for a vulnerability is due no later than 14 days after a corrective or mitigating measure is available; for an incident, within one month after the 72-hour notification. The Commission’s reporting page states that the ENISA Single Reporting Platform (Article 16) became operational on 11 September 2026: a manufacturer reports once, and the report goes to the CSIRT of its main establishment and to ENISA at the same time. Open-source stewards begin reporting from 11 December 2027. The Commission published implementation guidance on 27 July 2026.

Penalties

Infringement (Article 64)	Maximum administrative fine
Annex I essential requirements; Articles 13 and 14	EUR 15,000,000 or 2.5% of worldwide annual turnover, whichever is higher
Other listed obligations (Articles 18-23, 28, 30-33, 39, 41, 47, 49, 53)	EUR 10,000,000 or 2% of worldwide turnover, whichever is higher
Incorrect, incomplete or misleading information to notified bodies or authorities	EUR 5,000,000 or 1% of worldwide turnover, whichever is higher

Under Article 64(10), no fines apply to micro and small enterprises for missing the Article 14(2)(a) and 14(4)(a) deadlines, nor to open-source stewards.

Common mistakes

Treating all published code as in scope, or all as out. The test is supply in the course of commercial activity (recitals 17-18), not whether the licence is open.
Setting a fixed five-year support period without a basis. Article 13(8) ties the period to expected use time and requires the reasoning to be recorded.
Assuming the Act ends at placing on the market. The Article 14 reporting duty and the support period run afterwards.
Applying the CRA to a regulated medical device. Devices under Regulations 2017/745 and 2017/746 are handled by their own regime (recital 25).

Related programs

Instrument	Relationship to the CRA
NIS2	Commission describes the CRA as complementing it
Regulations (EU) 2017/745 and 2017/746	Medical devices are excluded from the CRA (recital 25)
EU AI Act high-risk systems	A separate EU regulation, covered in its own guide
ISO/IEC 27002	Organisational security controls, a different layer from product requirements

For general background, see what is cybersecurity.

FAQ

When does the EU Cyber Resilience Act apply?

It entered into force on 10 December 2024 and applies generally from 11 December 2027. Chapter IV applied from 11 June 2026 and the Article 14 reporting obligations from 11 September 2026 (Article 71).

Who must comply?

Manufacturers of products with digital elements made available on the EU market. Products covered by the medical-device, vehicle, aviation or defence regimes are excluded.