Last Updated on March 27, 2026
Show deadlines associated with the Cyber Resilience Act (CRA)
Objectives
Mandatory cybersecurity requirements for products with digital elements offered in the EU market are established by the CRA. Its main aims include the following: (i) to bolster the cybersecurity of digital products, (ii) to shield consumers and businesses from the dangers of insufficient cybersecurity measures, and (iii) to motivate producers to adopt a security-by-design approach throughout the entire lifecycle of digital products; and (iv) enhance current cybersecurity regulations.
Important Dates
10 December 2024
The Cyber Resilience Act (2024/2847) (the CRA) was adopted by the European Commission.
- https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02024R2847-20241120
- https://digital-strategy.ec.europa.eu/en/policies/cra-summary
11 December 2025
Release of implementing act: technical descriptions for important/critical products.
When a product with digital elements has the core functionality of a product category set out in Annexes III and IV, it is considered an important or critical product with digital elements. It is subject to the corresponding conformity assessment procedures.
- Read Annex III to learn which products are important
- Read Annex IV to learn which products are critical
- Read the technical descriptions of such products
13 April 2026
The European Commission is preparing a communication that will provide guidance on how to apply the Cyber Resilience Act (CRA) in practice. The guidance will help manufacturers, developers, and other stakeholders understand their obligations under the regulation and ensure a consistent approach across the EU. It will clarify how key provisions of the CRA should be interpreted and implemented. Stakeholders are encouraged to submit their comments to this consultation by using the attached template to facilitate feedback consolidation. The feedback period is 03 March 2026 – 13 April 2026.
11 June 2026
Requirements for conformity assessment bodies (institutions that check compliance with safety standards) come into force. Governments must be ready, and assessment bodies must be in place as per articles 35 to 51.
30 August 2026
Release of horizontal framework (general principles). Horizontal standard on vulnerability handling. Harmonized process standards: horizontal (Module A)
11 September 2026
Manufacturers have obligations to report vulnerabilities and security incidents for actively exploited vulnerabilities & severe incidents for all products as per article 14. This reporting obligation does not only apply to new products but all products. Please note that there is no obligation for a fix.
30 October 2026
Release of vertical standards for important/critical products (Modules B+C). Broad vertical standard for OT based on ISA/IEC 62443-4-1, -4-2, and 3-3.
11 December 2026
Notification of conformity assessment bodies.
30 October 2027
Release of horizontal standard on generic cybersecurity requirements (based on EN 18031). Harmonized product standards: horizontal (Module A)
11 December 2027
Every provision of the CRA comes into effect. Products cannot be sold on EU markets if they don’t comply with the CRA. OEMs must anticipate which products will be placed on the EU market after December 11, 2027, and ensure those products will meet CRA requirements.
Updates
Additional information was added from here.
Conclusion
You want to get ready for the Cyber Resilience Act (CRA)? You use the Yocto Project® and would like to know how it can help you to tackle the challenges associated with it. Furthermore, you don’t have security experts on your team and still need to find a solution? Stay tuned for our upcoming “CRA compliance with the Yocto Project®” training.
If you are keen to learn how embedded Linux works plus some Linux with additional real-time, click here. To learn more about the Yocto Project®, take a look here.
