Cyber Resilience Act: CRA deadlines and news
The CRA sets cybersecurity rules for products with digital elements sold in the EU. Every entry names its source and says whether it is binding law or guidance.
Coming up
Target date for a sufficient number of notified bodies in the Union
Article 35(2) asks Member States to strive to ensure by 11 December 2026 that there are enough notified bodies to avoid bottlenecks at market entry. The wording is 'shall strive', so it is a target for Member States.
Final joint report of the standardisation bodies on the CRA request due
Article 4(3) of Implementing Decision C(2025) 618 requires CEN, CENELEC and ETSI to give the Commission their final joint report by 30 October 2027. The decision itself expires on 30 November 2027.
Main obligations of the Cyber Resilience Act start to apply
Under Article 71(2) the Regulation applies from 11 December 2027. Under Article 69(2), products placed on the market earlier fall under it only after a substantial modification, while the Article 14 reporting duties already cover them. The Commission reads Article 71(2) as starting the reporting duties of open-source software stewards under Article 24(3) on this date.
EU type-examination certificates under other harmonisation law remain valid until this date at the latest
Article 69(1): EU type-examination certificates and approval decisions on cybersecurity requirements issued under other Union harmonisation legislation remain valid until 11 June 2028, unless they expire earlier or that legislation provides otherwise.
Commission report on the effectiveness of the single reporting platform due
Article 70(2): by 11 September 2028 the Commission, after consulting ENISA and the CSIRTs network, reports to Parliament and Council on the effectiveness of the single reporting platform and on the effect of delayed dissemination of notifications.
First Commission evaluation report on the Cyber Resilience Act due
Article 70(1): by 11 December 2030 and every four years after that, the Commission reports to Parliament and Council on the evaluation and review of the Regulation. The reports are made public.
2026
ENISA upgrades the CRA single reporting platform to version 1.2.1
ENISA states that on 20 October 2026 the platform was upgraded to version 1.2.1, with a different process to invite secondary Assigned Representatives; the older way stays available for a short period.
Germany: Bundestag passes the law implementing the Cyber Resilience Act
The Bundestag adopts the act implementing Regulation (EU) 2024/2847 with votes from CDU/CSU, SPD and the Greens; it makes the BSI the market surveillance and notifying authority. The Bundesrat still has to deal with it, so it is not yet in force.
Germany: Interior Committee recommends the CRA act with a new entry into force
On 14 October 2026 the Interior Committee recommends passing the CRA bill unchanged except for entry into force: provisions whose dates of 11 June and 11 September 2026 have passed apply the day after promulgation, the rest from 11 December 2027. This is a committee recommendation on a bill, not law.
Italy: draft CRA decree (Atto del Governo 447) goes to Parliament and names ACN as notifying and market surveillance authority
Transmitted on 9 October 2026, the draft designates the National Cybersecurity Agency (ACN) as notifying authority (Article 4) and market surveillance authority (Article 9(1)); the committees have until 18 November 2026 for their opinion. It is a draft, not law.
Ireland: National Cyber Security Strategy 2030 plans a law to designate the CRA authorities by the fourth quarter of 2027
The Department of Justice, Home Affairs and Migration published the Strategy on 7 October 2026. It sets the fourth quarter of 2027 as the target for enacting a law that designates a notifying authority and a market surveillance authority for the Cyber Resilience Act and provides for penalties; it is a policy document, so the designation is still to come.
Denmark: draft law supplementing the Cyber Resilience Act goes to public consultation
On 5 October 2026 the Ministry for Societal Security and Preparedness published a draft bill that names the Agency for Societal Security (Styrelsen for Samfundssikkerhed) as notifying authority and market surveillance authority, with comments due by 2 November 2026. It is a draft for consultation, not law; it would apply from 1 March 2027, and its market surveillance and penalty sections from 11 December 2027.
Italy: Council of Ministers takes up the draft decree adapting national law to the CRA in preliminary examination
The agenda of Council of Ministers meeting no. 191 lists the legislative decree adapting national law to Regulation (EU) 2024/2847 for preliminary examination. A preliminary reading is not final adoption.
Croatia: NCSC-HR announces the EU Single Reporting Platform for CRA reports
NCSC-HR, listed by ENISA as Croatia's coordinating CSIRT, announces that the Single Reporting Platform is live and that manufacturers must report actively exploited vulnerabilities and significant incidents there. The notice is authority guidance on a binding EU duty; no Croatian CRA implementing act was found.
Cyprus: Commissioner of Communications names his Office as CRA notifying and market surveillance authority
In an article of 23 September 2026 the Commissioner of Communications states that his Office, through the Digital Security Authority, acts as notifying authority and will act as market surveillance authority under the Cyber Resilience Act, and that the national CSIRT receives the manufacturers' notifications. This is a statement by the authority, and the article does not cite the legal act that made the designation.
Reporting obligations for actively exploited vulnerabilities and severe incidents start to apply
Under Article 71(2), Article 14 applies from 11 September 2026: an early warning within 24 hours, a notification within 72 hours and a final report (14 days after a fix for vulnerabilities, one month for incidents). Under Article 69(3) it also covers products placed on the market before 11 December 2027.
ENISA deploys the CRA single reporting platform
ENISA announces the initial operating capability of the single reporting platform required by Article 16, through which manufacturers file their Article 14 notifications.
Germany: BSI says CERT-Bund is the coordinating CSIRT for CRA reports and publishes step by step guides
On the day the reporting duty starts, the BSI states that notifications go through the ENISA platform to the competent coordinating CSIRT (CERT-Bund in Germany) and to ENISA, and offers step by step instructions.
Ireland: NCSC publishes national guidelines on CRA reporting obligations
The National Cyber Security Centre guidelines explain reporting thresholds, timelines, notification procedures and the information required when submitting a report. They are non-binding guidance, announced by the Department of Justice, Home Affairs and Migration.
Malta: Legal Notice 238 of 2026 designates the Malta Digital Innovation Authority and the national CSIRT for the CRA
The Cyber Resilience Regulations 2026, published in Government Gazette No. 21,717, designate the Malta Digital Innovation Authority as notifying and market surveillance authority and the national CSIRT as coordinator. Regulations 3 to 7 and 9 to 12, including the market surveillance designation, come into force on 11 December 2027.
Latvia: CERT.LV states that it processes CRA reports submitted through the ENISA platform
CERT.LV announces that manufacturers must report actively exploited vulnerabilities and serious incidents from 11 September 2026 through the ENISA Single Reporting Platform, and that CERT.LV processes the submitted reports in Latvia. The notice is authority guidance on a binding EU duty.
Netherlands: House of Representatives adopts the CRA implementation bill
The Tweede Kamer adopts bill 36 875 on 10 September 2026. The Eerste Kamer committees are now reviewing it, so it is not yet law.
Slovenia: URSIV explains the CRA reporting duties that apply from 11 September 2026
URSIV, the Government Office for Information Security, explains the 24 hour early warning and 72 hour notification for manufacturers and points to the ENISA Single Reporting Platform. The legal register PISRS lists a government decree implementing the Regulation, prepared by URSIV, as still in preparation, so the page is guidance and no national implementing act is listed as adopted.
Slovakia: Government approves the bill on cybersecurity of products with digital elements
By resolution 356/2026 of 26 August 2026 the government approved the National Security Authority's CRA bill and sent it to parliament. The bill names the NBU as market surveillance authority and the standards office UNMS as notifying authority, and would apply from 1 January 2027 with the main duties from 11 December 2027; it is a bill, not law.
Germany: BSI publishes Technical Guideline TR-03183 Part 1, version 1.0.0, as an entry aid to the CRA
The guideline on general requirements has no binding force. It targets manufacturers without mature security processes and comes with an initial selection of measures in the machine-readable OSCAL format.
Commission publishes guidance on the application of the Cyber Resilience Act
Communication C(2026) 5252 with an annex explains scope (including remote data processing and open-source software), substantial modification, support periods and the reporting duties. It is non-binding Commission guidance.
Czech Republic: draft law on cybersecurity of products with digital elements goes to inter-ministry comment
On 3 July 2026 the Ministry of Industry and Trade sent its CRA adaptation draft to inter-ministry comment. The draft makes NUKIB the notifying authority and the receiver of Art. 14 and 15 reports, and leaves market surveillance with existing bodies such as the Czech Trade Inspection Authority and the Mining Authority; it is a draft, not law, and would apply from 11 December 2027 (two sections on promulgation).
CRA market surveillance authorities hold the second AdCo meeting in Berlin
The national authorities set up technical and legal working groups, discuss monitoring of the reporting duties and cooperation with the CSIRTs, and examine machine-readable formats for documenting requirements. The BSI chairs the group.
Germany: Bundesrat raises no objections to the CRA implementation bill
At its 1066th session the Bundesrat decides not to raise objections to the bill under Article 76(2) of the Basic Law, as recorded in Bundestag paper 21/6512 of 15 June 2026.
Provisions on the notification of conformity assessment bodies start to apply
Under Article 71(2), Chapter IV (Articles 35 to 51) applies from 11 June 2026. From then Member States can assess, notify and monitor the bodies that carry out third party conformity assessment.
Germany: Bundestag holds the first reading of the CRA implementation bill
After a 20 minute debate the Bundestag refers bill 21/6134 to the Interior Committee, which leads the work. A first reading ends with a referral, not a vote on the law.
ENISA publishes technical competence requirements for CRA notified bodies
Version 1.0 describes the knowledge, skills and experience expected of staff at conformity assessment bodies that apply for notification under the Regulation. It is non-binding guidance.
Finland: national act supplementing the Cyber Resilience Act enters into force
The act enters into force on 1 June 2026 and assigns market surveillance, vulnerability reporting and the notification of conformity assessment bodies to Traficom's National Cyber Security Centre (NCSC-FI). It is binding national law, reported by Traficom on 2 June 2026.
Germany: Federal Government tables the bill implementing the Cyber Resilience Act in the Bundestag
Bundestag paper 21/6134 designates the BSI as market surveillance and notifying authority, sets up a consumer complaints office and fine procedures, and amends the BSI Act, the Telecommunications Act and the Energy Industry Act. It is a bill, not law.
Poland: Ministry of Digitalisation says CERT Polska (CSIRT NASK) coordinates CRA vulnerability reports
A guidance page on gov.pl dated 25 May 2026 says that under the Polish cybersecurity system act (consolidated text, Dz.U. 2026 poz. 20) CERT Polska, acting as CSIRT NASK, is the coordinator for CRA vulnerability reports. It names no market surveillance authority and is non-binding guidance, not a Polish CRA implementing law.
Spain: CNMC reports on the draft Royal Decree naming the CRA authorities
On 13 May 2026 the competition and markets authority CNMC approved its report on the draft Royal Decree that designates the notifying and market surveillance authorities under Regulation (EU) 2024/2847. The draft names the State Secretariat for Telecommunications and Digital Infrastructure (SETID) as market surveillance authority and the National Cryptologic Centre (CCN) as notifying authority. It is a draft and the report is advisory, so none of this is enacted law yet.
Delegated Regulation (EU) 2026/881 on delaying the dissemination of CRA notifications published
Adopted on 11 December 2025 under Article 14(9) and published on 20 April 2026, it sets the terms for the cybersecurity grounds on which a coordinating CSIRT may delay passing a notification on to other CSIRTs. It is binding and enters into force on the twentieth day after publication (10 May 2026).
BSI takes over the chair of the CRA Administrative Cooperation Group
At the session of the AdCo CRA in Athens on 19 March 2026 the chair passes to the BSI, with a vice-chair from the Digital Security Authority of Cyprus. The AdCo is the cooperation forum of the national market surveillance authorities.
France: ministry explainer names ANSSI as notifying authority and ANFR as market surveillance authority for the CRA
The explainer of the Direction generale des Entreprises says ANSSI will act as notifying authority and that market surveillance will be carried out by ANFR with ANSSI technical support. It does not cite the legal act that designates them.
Commission publishes draft Cyber Resilience Act guidance for feedback
The draft covers remote data processing, free and open-source software, support periods and the link to other EU law; the news item gives 31 March 2026 as the end of the feedback period. It is a draft and non-binding.
2025
Hungary: Act CXXXV of 2025 makes SZTFH the CRA notifying and market surveillance authority
Published in Magyar Kozlony on 29 December 2025, Act CXXXV of 2025 is enacted law that adds a CRA chapter to the Hungarian cybersecurity act and gives the Supervisory Authority for Regulated Activities (SZTFH) both roles. The notifying authority rules apply from 11 June 2026, the market surveillance and fine rules from 11 December 2027.
Netherlands: government submits the bill implementing the Cyber Resilience Act to the House of Representatives
The Uitvoeringswet verordening cyberweerbaarheid (Kamerstuk 36 875) is submitted to the Tweede Kamer on 18 December 2025. It is a bill, not yet law.
Sweden: inquiry proposes a supplementary law for the Cyber Resilience Act
The Cyber Resilience inquiry handed its report (SOU 2025:115) to the Government on 9 December 2025, proposing the Post and Telecom Authority (PTS) as market surveillance authority, Swedac as notifying authority and MSB as the recipient of reports. It is an inquiry proposal, sent for consultation on 26 January 2026 with replies due by 22 April 2026, not a bill or law.
Commission publishes FAQ on Cyber Resilience Act implementation
The Commission publishes answers to frequently asked questions on applying the Regulation. The FAQ is non-binding guidance; the page shows a last update on 4 September 2026.
Implementing Regulation (EU) 2025/2392 on the technical description of important and critical product categories published
Adopted on 28 November 2025 under Article 7(4) and published on 1 December 2025, it sets the technical description of the product categories in Annexes III and IV of the Regulation. It is binding and enters into force on the twentieth day after publication (21 December 2025).
Slovakia: Act 318/2025 adds fines for authorised conformity assessment bodies under the CRA
Act No. 318/2025 Coll., adopted on 21 October 2025 and published on 21 November 2025, amends the conformity assessment Act 56/2018. From 1 January 2026 the standards office can fine authorised bodies at the Art. 64(3) CRA amounts for breaching Arts. 39, 41, 47 and 49; it is enacted law but does not designate the CRA market surveillance authority.
Commission proposes a single entry point for incident reporting that builds on the CRA reporting platform
The Digital Omnibus proposal (COM(2025) 837) would have ENISA run a single entry point for incident notifications under several EU laws, building on ENISA's experience with the CRA single reporting platform. The Commission states it would not modify existing reporting obligations; the proposal is still in the legislative process.
Delegated Regulation (EU) 2025/1535 excludes L category vehicles from the Cyber Resilience Act
Adopted on 29 July 2025 under Article 2(5) and published on 29 October 2025, the delegated act excludes products with digital elements within the scope of Regulation (EU) No 168/2013, except L1e vehicles designed to pedal. It is binding and enters into force on the twentieth day after publication.
Germany: BSI announces its designation as CRA notifying and market surveillance authority
The BSI announces that the Federal Government has designated it to the European Commission as notifying authority and market surveillance authority under the Regulation. A national implementing bill followed in May 2026.
CEN, CENELEC and ETSI accept the Cyber Resilience Act standardisation request
The three standardisation organisations accept request M/606 and commit to deliver harmonised standards at least one year before the Regulation applies. Under Article 27(1), meeting a harmonised standard gives a presumption of conformity only once its reference is published in the Official Journal.
Commission adopts the standardisation request for the Cyber Resilience Act
Implementing Decision C(2025) 618 (request M/606) asks CEN, CENELEC and ETSI to draft European standards in support of the Regulation, 41 in total according to the Commission. It is addressed to the standardisation bodies, sets no duties for manufacturers and expires on 30 November 2027.
2024
Cyber Resilience Act enters into force
Under Article 71(1) the Regulation enters into force on the twentieth day after publication. Its obligations apply later in stages: Chapter IV from 11 June 2026, Article 14 from 11 September 2026 and the rest from 11 December 2027.
Cyber Resilience Act published in the Official Journal
Regulation (EU) 2024/2847, dated 23 October 2024, is published in the Official Journal on 20 November 2024. It is binding in its entirety and directly applicable in all Member States.
Council adopts the Cyber Resilience Act
The Council adopts the Regulation after Parliament's first reading position of 12 March 2024. Signature on 23 October 2024 and publication in the Official Journal followed.
Commission opens a call for applications to the Cyber Resilience Act Expert Group
The Commission invites experts to apply to an expert group of up to 60 members on the cybersecurity of products with digital elements. The group advises the Commission and assists with delegated acts and guidance documents.
European Parliament adopts the Cyber Resilience Act at first reading
Parliament adopts its first reading position (T9-0130/2024), which reflects the agreement with the Council. Formal adoption by the Council followed on 10 October 2024.
2023
Parliament and Council reach a provisional agreement on the Cyber Resilience Act
Negotiators of the European Parliament and the Council agree on the text on the night of 30 November 2023, as confirmed by a Commission statement of 1 December 2023. The agreement still needed formal adoption by both institutions.
European Parliament committee votes on its position on the Cyber Resilience Act
The Committee on Industry, Research and Energy (ITRE) votes on its report and decides to open negotiations with the Council. A committee vote is a step in the procedure, not an adopted law.
Council agrees its negotiating position on the Cyber Resilience Act
EU member states agree a common position on the proposal in the Council. It is a negotiating mandate for the talks with Parliament, not an adopted act.
2022
Commission proposes the Cyber Resilience Act
The Commission presents its proposal (COM(2022) 454) for a regulation on mandatory cybersecurity requirements for products with digital elements. A proposal creates no obligations until it is adopted.
Sources
30
This page is regularly updated from the following official and journalistic sources.
Tem de tratar da NIS2?
Acompanhamos passo a passo. Preenche, nós explicamos cada ponto em palavras simples e, no fim, a direção assina.
