The Cyber Resilience Act applies in steps. One of them is already in force for every connected product you sell today.
Five dates, four of them already behind us.
Regulation (EU) 2024/2847, the Cyber Resilience Act, is published in the Official Journal of the EU.
The regulation enters into force. The transition periods start.
The rules for notifying conformity assessment bodies apply, so notified bodies can be designated in time.
The reporting obligations of Article 14 apply: actively exploited vulnerabilities and severe incidents must be reported within 24 hours. This covers every product with digital elements on the EU market, including products placed on the market before December 2027.
All other obligations apply, including the essential requirements of Annex I, conformity assessment and CE marking.
If you sell connected products in the EU today, you need a working reporting process now, not in 2027. Reporting applies to products already on the market.
The essential requirements and CE marking apply to products placed on the market from 11 December 2027. Products placed on the market earlier only fall under them if they are substantially modified afterwards.
Development cycles of two to four years mean that products designed today will be sold after December 2027. Security requirements therefore belong in the current design phase.
A practical order of work that follows the dates above.
Now
Roles, triggers and decision rules for the 24 hour deadline, and access to the reporting platform.
Now
A list of all products with digital elements you place on the EU market, with their software components.
Next six months
Product class per product and a gap analysis against the essential requirements of Annex I.
In development
Risk assessment and security requirements for every product that will be sold after December 2027.
2027
Technical documentation, conformity assessment and EU declaration of conformity.
From December 2027
CE mark on new products, then vulnerability handling and updates for the whole support period.
As of October 2026. These guides explain the regulation in plain language and are not legal advice.
We turn the dates into a plan per product, from the reporting process to the CE mark.
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.
