CRA Article 14 reporting, explained
What a manufacturer sends under the Cyber Resilience Act (CRA) Article 14 at 24 hours, at 72 hours and in the final report.
CRA timeline: dates and deadlines
Usama · Founder
Checked against the regulation on 16 Oct 2026 · What changed
These are the dates in Regulation (EU) 2024/2847 and the Commission summary of that regulation. Reporting does not wait for the rest of the duties. A date in the table is linked to the article that sets it, or to the page on this site that explains it. Most teams plan around two dates. Article 14 reporting has applied since 11 September 2026, so a team needs to know today who sends the 24-hour early warning. The rest of the duties apply from 11 December 2027, which is the date to plan the SBOM, vulnerability handling, technical file and CE marking work around.
When the Cyber Resilience Act applies
| Date | What applies | Where it is written |
|---|---|---|
| 10 Dec 2024 | The regulation enters into force, on the twentieth day after publication in the Official Journal. | Article 71 |
| 11 Jun 2026 | Chapter IV applies: Member States notify the bodies that will assess certain products. Notifying authorities were to be designated by this date. | Article 71 and Articles 35 to 51 |
| 11 Sep 2026 | Article 14 applies. Manufacturers report an actively exploited vulnerability or a severe incident: an early warning within 24 hours of becoming aware, a notification within 72 hours, then a final report. ENISA's Single Reporting Platform has been operational from this date. | Article 14, Article 16 and Article 71 |
| 11 Dec 2027 | The rest of the regulation applies: essential cybersecurity requirements, vulnerability handling, technical documentation, conformity assessment and CE marking. Open-source software stewards' reporting under Article 24(3) applies from this date, not from September 2026. | Article 71 and Article 24 |
| 11 Dec 2027 | A product placed on the market before this date meets the full requirements only if it is substantially modified afterwards. Article 14 reporting applies to products already made available, including those, without waiting for that modification. | Chapter VIII and Article 14 |
| 11 Jun 2028 | EU type-examination certificates and approval decisions issued for cybersecurity requirements stay valid until this date, unless they expire sooner. | Chapter VIII, Commission summary |
Where to read on
Changes
- 16 Oct 2026. Page created from Article 71 and the Commission summary of the regulation.
Related
Usama
Founder of Samisoftz. He writes these pages and builds the software. About Usama
Which of these dates is the one on your desk?
You'll talk to Usama, who'd build it.
30 minutes · no slides · a written answer if it's not a fit
One fixed price, in writing, the same day you ask · a delivery date agreed in writing · about 4 hours of your engineers' time · the price only changes if the scope does.
NDA before anything sensitive · the drill runs on sample data · no production access · every document is yours.