News

Regulation

Cyber Resilience Act: what has applied since September 11, 2026, and what arrives in 2027

By Lionel

November 4, 2026

5 min read

Cyber Resilience Act application timeline 2026 and 2027

The Cyber Resilience Act is no longer an upcoming text. Since September 11, 2026, a first obligation applies to every manufacturer of connected products sold in Europe. The next one, by far the heaviest, arrives in thirteen months.

This article replaces our first guide published in February 2026. It reviews what is enforceable today, what will be on December 11, 2027, and what an IoT or embedded product team needs to start now.

One regulation, three dates

Date	What applies
December 10, 2024	Entry into force of Regulation (EU) 2024/2847
June 11, 2026	Provisions on the notification of conformity assessment bodies
September 11, 2026	Reporting obligations for actively exploited vulnerabilities and severe incidents (Article 14)
December 11, 2027	Full application: essential requirements, conformity assessment, CE marking

The CRA covers “products with digital elements” placed on the European market: connected devices, industrial equipment, software, components. Some sectors already covered by specific regulations are excluded, notably medical devices, automotive and aviation.

Reporting a vulnerability within 24 hours under the CRA

What has been enforceable since September 11, 2026

A single obligation, but one with no transition period.

A manufacturer that becomes aware of an actively exploited vulnerability in one of its products, or of a severe incident affecting its security, must report it according to three deadlines:

Within 24 hours: an early warning.
Within 72 hours: a full notification, with the first measures taken.
A final report: no later than 14 days after a fix is made available for a vulnerability, and within one month for a severe incident.

Reports are submitted on the single reporting platform operated by ENISA, opened on September 11, 2026. They are forwarded to the coordinating national CSIRT, CERT-FR for a manufacturer established in France.

The point many have missed

This obligation also applies to products already on the market, including those that will never be brought into compliance with the rest of the regulation. A device sold in 2019 and still in service at your customers’ sites is concerned.

What this means in practice

Reporting within 24 hours requires groundwork:

a public entry point to receive reports from researchers and customers
an inventory of products in service, with their firmware versions and components
a person and a deputy authorized to report on the platform
a procedure stating who qualifies exploitation as “active” and who decides to notify.

The attack on Danfoss refrigeration controllers in October 2026 illustrates exactly the kind of situation targeted: older-generation equipment, known vulnerabilities, large-scale exploitation.

What arrives on December 11, 2027

From that date, a product can no longer be placed on the European market without complying with the whole regulation.

The essential requirements (Annex I, Part I)

Among other things, the product must:

be placed on the market without known exploitable vulnerabilities
be delivered with a secure-by-default configuration
protect access with appropriate authentication
ensure the confidentiality and integrity of data and commands
limit its attack surface, including external interfaces
be able to receive security updates.

On an embedded product, these lines translate very concretely. A factory password shared across the whole fleet, a UART port left enabled in production or a key hardcoded in the firmware are all non-conformities.

Vulnerability handling (Annex I, Part II)

The manufacturer must:

maintain a software bill of materials (SBOM) for its product
fix vulnerabilities without delay and distribute patches free of charge
test the product’s security regularly
put a coordinated vulnerability disclosure policy in place
ensure this follow-up throughout the support period, of at least five years unless the expected period of use is shorter.

Conformity assessment

Most products fall under self-assessment by the manufacturer. Products classified as “important” or “critical” (Annexes III and IV of the regulation) are subject to more demanding procedures, which may involve a third-party body.

Penalties

Failure to meet the essential requirements exposes the manufacturer to a fine of up to 15 million euros or 2.5% of worldwide annual turnover. Market surveillance authorities can also require the product to be withdrawn.

CRA compliance roadmap for a manufacturer

Thirteen months: where to start

A hardware design cycle often lasts more than a year. For a product due in 2028, decisions are being made now.

Determine whether your products are in scope, and in which class.
Measure the gap. Compare an existing product with the Annex I requirements, preferably through a security test rather than a documentation review.
Build the SBOM, including for components delivered in binary form by your suppliers.
Organize vulnerability handling: point of contact, procedure, ability to produce and distribute a fix.
Set the support period of each product and include it in the business model.
Train the design teams. CRA requirements cannot be met at the end of a project. They are decided at the architecture stage.

Where training plays a role

No training makes a product compliant. Compliance is built through design choices, testing and organization.

However, a requirement such as “limit the attack surface” or “protect the integrity of updates” remains abstract until you have seen what an attacker does with a debug interface or an unsigned firmware. This is the purpose of the DVID CRA path: 22 modules covering the Annex I requirements, each illustrated by a demonstration on real hardware. The program is detailed in our training programs.

For teams carrying out the security tests required by the regulation, our new certification path validates the skills of the people who design, buy and audit.

Frequently asked questions

Is the CRA already in force?

Yes, since December 10, 2024. It applies gradually: reporting since September 11, 2026, full application on December 11, 2027.

My product was placed on the market before 2027. Am I concerned?

By the reporting obligations, yes, starting today. By the essential requirements, only if the product undergoes a substantial modification after December 11, 2027.

What is the difference with the RED directive and the EN 18031 standard?

The cybersecurity requirements of the RED directive have applied to radio equipment since August 1, 2025, with the EN 18031 series of standards as the reference. The CRA has a broader scope, since it covers all products with digital elements, and adds obligations over the whole lifecycle. The cybersecurity part of the RED will be repealed on December 11, 2027, when the CRA fully applies. See RED directive and EN 18031.

Whom should I notify in France?

Reports are made on ENISA’s single reporting platform, which forwards them to CERT-FR.