The EU Cyber Resilience Act, by date
Regulation (EU) 2024/2847 entered into force on 10 December 2024 and applies in stages. Almost every summary quotes one date, December 2027. One obligation is already running.
The timeline
| Date | What starts | Who it binds |
|---|---|---|
| 10 Dec 2024 | Entry into force | Nobody yet — the clock starts for the stages below |
| 11 Jun 2026 | Chapter IV, notification of conformity assessment bodies | Notified bodies, not products |
| 11 Sep 2026 | Article 14 reporting obligations | Manufacturers. In force now. |
| 11 Dec 2027 | Everything else: essential requirements, conformity assessment, CE marking, technical documentation | Manufacturers, importers, distributors |
Does it apply to you
Three questions decide it, and all three are commercial rather than technical.
1. Is it placed on the market in the course of a commercial activity
Free and open-source software supplied outside a commercial activity is out of scope. The threshold for “commercial” is broader than selling a licence: paid support, hosting with a service level agreement, or professional services built around the software all count.
A legal entity that provides sustained support to open-source software without monetising it may instead be an open-source software steward under Article 24, with a much lighter set of obligations centred on a documented cybersecurity policy.
2. Which class
Most products are assessed under internal control. Products listed in Annex III (important, class I or II) and Annex IV (critical) follow stricter routes, which can require a notified body. Password managers, network management systems, operating systems, firewalls and identity management systems are examples of the listed categories.
3. What is your role
Manufacturer, importer and distributor carry different obligations. A company outside the EU that sells to EU consumers is still in scope.
The penalties
| Tier | Ceiling | Applies to |
|---|---|---|
| Top | €15 000 000 or 2.5% of worldwide annual turnover | The essential requirements of Annex I, and the obligations in Articles 13 and 14 |
| Middle | €10 000 000 or 2% | Other obligations under the regulation |
| Lower | €5 000 000 or 1% | Supplying incorrect, incomplete or misleading information to authorities |
Whichever is higher, in each case. Market surveillance authorities can also require a product to be withdrawn or recalled.
What the regulation asks you to be able to show
Much of the CRA is about process and product design. A smaller part leaves evidence in a repository, and that part is unusually mechanical:
| Reference | Obligation | The artefact |
|---|---|---|
| Annex I Part II(1) | Software bill of materials | A machine-readable SBOM covering at least the top-level dependencies |
| Annex I Part II(5)(6) | Coordinated vulnerability disclosure | A published policy and a contact address for reports |
| Annex I Part II(4) | Public disclosure of fixed vulnerabilities | Advisories naming severity and affected versions |
| Art. 13(8), Annex II(7) | Support period | A stated end date, at least five years from placing on the market |
| Annex II | Information to the user | Manufacturer identity and postal address, point of contact, intended purpose, update instructions |
| Art. 28, Annex V | EU declaration of conformity | The signed declaration, and the address where users can reach it |
| Art. 31, Annex VII | Technical documentation | The file, kept available for ten years or the support period |
| Art. 14 | Reporting | A written procedure naming who files, where, and by when |
The thirteen product properties of Annex I Part I — secure defaults, access control, attack surface, exploit mitigation and the rest — are not on that list on purpose. They are a cybersecurity risk assessment under Annex VII(3), and no scan substitutes for one.
Find out what you cannot currently evidence
cra-ready checks a repository against the obligations in
the table above and reports what is missing, each with its article and the
date it becomes enforceable.
npx cra-ready ./your-projectFree and open source, zero dependencies, no network calls. The commercial tier generates the artefacts: the SBOM, the disclosure policy with the Article 14 procedure, and drafts of the declaration of conformity and technical documentation.
A summary of a regulation, written to be useful, not a substitute for reading it, and not legal advice. Scope, classification and how to answer an authority are questions for a professional.