Luca BertonThe CRA doesn't flip on like a switch. It has a phased implementation designed to give organizations time to adapt — but the clock is already ticking.
The Timeline
- October 2024 — CRA formally adopted by the European Parliament and Council
- December 2024 — Publication in the Official Journal; enters into force (20 days after)
- June 2026 — Notified body provisions apply (conformity assessment bodies must be designated)
- September 2026 — Vulnerability and incident reporting obligations begin. Manufacturers must report actively exploited vulnerabilities to ENISA within 24 hours
- December 2027 — Full compliance required. All products placed on the EU market must meet CRA essential requirements
What to Do Now
- Product inventory — Catalog all products with digital elements you sell in the EU
- Classification — Determine which category each product falls into
- Gap analysis — Compare current security practices against CRA essential requirements
- Vulnerability handling — Establish or improve your vulnerability disclosure and patching process (needed by September 2026)
- SBOM preparation — Start generating Software Bills of Materials for your products
📘 Book
Kubernetes Recipes
Practical guide for container orchestration and deployment — hands-on patterns you can use today.
View on Amazon →The September 2026 Trap
Many organizations focus on December 2027, but the reporting obligations starting September 2026 are arguably harder to implement. You need processes, tooling, and team training to detect, assess, and report vulnerabilities within 24 hours. Start now.
cra
compliance
timeline
deadlines
eu regulation