Where the CRA stands today
A running view of the Cyber Resilience Act's implementation; what has happened, what is in progress, and the dates still ahead.
September 2026
Milestones
Full application
The bulk of obligations apply; products placed on the market must meet the essential requirements and carry the CE marking.
UpcomingRemaining standards expected
The remaining horizontal harmonised standards are due; roughly a year before full application, so manufacturers can rely on them.
ExpectedVertical standards expected
The product-specific (vertical) harmonised standards are due to be delivered. Also pushed back two months by the July 2026 draft amendment, from 30 October 2026. Delivery is not the same as availability: a standard only confers the Article 27 presumption of conformity once cited in the Official Journal.
ExpectedFirst core standards expected
The two key horizontal standards (secure development and vulnerability handling) are due to be delivered. The Commission's July 2026 draft amendment to mandate M/606 moved this deadline back two months, from 30 August 2026.
ExpectedReporting obligations apply
Manufacturers must notify actively exploited vulnerabilities and severe incidents to ENISA and the national CSIRT. ENISA's single reporting platform (Article 16) is to be operational by this date.
ImminentETSI vertical drafts under Public Enquiry
ETSI opened the formal approval procedure on 17 vertical final draft standards (the EN 304 xxx series, covering Annex III products from routers to connected toys). Comment windows close between mid-September and mid-November 2026, depending on the vertical. The drafts are publicly readable.
In progressChapter IV applies
The provisions on notification of conformity-assessment bodies take effect, so notified bodies can be designated ahead of full application.
CompleteGuidance & standards development
The Commission approved the content of its Article 26 application guidance in July 2026 (formal adoption follows once all EU-language versions are ready), alongside a living FAQ, while the European standards bodies draft the harmonised standards.
In progressStandardisation request accepted
CEN, CENELEC and ETSI accepted the Commission's request M/606 to develop around 41 harmonised standards (15 horizontal and the remainder vertical, product-specific).
CompleteEntered into force
The CRA became law across the EU; the implementation clock started.
CompleteAdopted and signed into law
The Regulation was formally adopted by the European Parliament and Council.
Complete