The clock

The CRA calendar: what applies already, and what applies from 11 December 2027.

Some of these dates are in the regulation. Some are proposed and have already moved once. Some have passed. The page says which is which.

Status as of 2 October 2026

CRA application dates

1. 10 December 2024

   In the regulation

   Entry into force

   Regulation (EU) 2024/2847 enters into force.

2. 11 June 2026

   In the regulation

   Notified bodies

   Chapter IV applies: conformity assessment bodies can be notified.

3. 11 September 2026

   In the regulation

   Reporting duties in force

   Reportable since this date, for products already on the market.

4. Today

5. 31 October 2026

   Proposed

   Horizontal core standards due

   The principles and risk-process standard and the vulnerability-handling standard, under the Commission's draft amendment to the standardisation request.

   Originally 30 August 2026

6. 31 December 2026

   Proposed

   Vertical standards due

   Product-category standards for Annex III products.

   Originally 30 October 2026

7. 2027

   Expected

   First citations in the Official Journal

   Presumption of conformity becomes available where a cited standard is applied in full.

8. 30 October 2027

   In the regulation

   Remaining horizontal standards due

   Technical measures, including the generic security controls. Date from the standardisation request.

9. 11 December 2027

   In the regulation

   Full application

   Annex I essential requirements, technical documentation, conformity assessment and CE marking apply in full.

10. After full application

    Ongoing

    The support period

    At least five years, or the expected time in use if that is shorter. Vulnerabilities must be handled for all of it.

What matters now

1. Decide which products are in scope, and in which class

   Default, important class I or II, or critical. The class decides the conformity route and who has to be involved.

   Atrekos: partly

   Atrekos suggests a class from the target of evaluation you describe. The decision stays yours.

2. Do the risk assessment now, against the regulation text

   Do not wait for the harmonised standards. An assessment done against Annex I today is what the standards will be measured against.

   Atrekos: yes

   This is the product.

3. Build the technical documentation around it

   Annex VII puts the risk assessment inside the file, next to the architecture, the vulnerability-handling procedures and the support-period reasoning.

   Atrekos: partly

   Atrekos produces the assessment and its projections, not the whole file.

4. Stand up vulnerability handling and the reporting path

   Article 14 applies now. Annex I Part II binds from 11 December 2027, and the 24-hour clock starts when you become aware, not when you are ready.

   Atrekos: partly

   Atrekos tracks Annex I Part II status; reporting and SBOM are outside it.

5. Plan the support period and how the assessment stays current

   Decide now how a change is re-assessed, and who does it.

   Atrekos: yes

   Re-run, diff, clone.

6. If the product is class II or critical, talk to a notified body early

   Third-party conformity assessment takes time and the bodies are only being notified since June 2026.

   Atrekos: yes

   The third-party module is built for that conversation.