The dates that matter
- 20 November 2024 — the CRA entered into force. The clock starts here.
- 11 June 2026 — provisions on notified bodies apply, so conformity assessment bodies can be designated in time.
- 11 September 2026 — reporting obligations apply. From this date manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA and their CSIRT, for products already on the market.
- 11 December 2027 — full application. From this date no product with digital elements may be placed on the EU market unless it complies with the essential requirements and carries CE marking on that basis.
What this means for a product in development in 2026
An embedded product typically takes 18-36 months from architecture freeze to volume production, and then stays on sale for 5-10 years. Anything whose architecture is being frozen now will still be shipping well past December 2027.
Consequences:
- Silicon choice is a compliance decision. Secure boot support, a hardware root of trust, sufficient flash for A/B update slots, and a vendor who will keep issuing security patches — these cannot be added later.
- Products already on the market are not grandfathered from reporting. From September 2026 the reporting duty attaches to products you have already sold, even though the design requirements do not apply retroactively.
- A substantially modified product is a new product. A major firmware release that changes the intended function or the risk profile re-triggers conformity assessment. Plan your release taxonomy so ordinary security patches do not accidentally count as substantial modification.
The support period
Manufacturers must determine a support period based on how long the product is reasonably expected to be in use — and it must be at least five years unless the product's expected lifetime is genuinely shorter. During that period, security updates must be provided free of charge and, once issued, remain available for at least ten years or the rest of the support period, whichever is longer.
For a device with a ten-year field life, that is a commitment to maintain a build chain, a signing infrastructure, and a vulnerability triage capability for over a decade. Budget for it now.
A workable internal timeline
| When | Do |
|---|---|
| Now | Classify products, inventory the portfolio, choose silicon with a security roadmap |
| By mid-2026 | Stand up the vulnerability handling process and reporting playbook |
| Sep 2026 | Reporting live: 24h early warning capability in place |
| 2027 | Technical documentation complete, conformity assessment done, DoC signed |