Every Cyber Resilience Act date that matters

The Cyber Resilience Act does not start on one day. It arrived in stages, some of them already behind us, and a few of its most important dates are not in the Act at all: it leaves them for the manufacturer to set. Here is each date, what it means, and what to have in place before it.

Dates already behind us

The Act became law. The Cyber Resilience Act entered into force on 10 December 2024, the twentieth day after its publication in the Official Journal.[Art. 71(1)] Nothing in it applied to a product on that day; it started the clock on everything below.

The bodies that check the stricter products could be appointed. The chapter on the notification of conformity assessment bodies applies from 11 June 2026, so that notified bodies can be in place before the main obligations apply.[Art. 71(2); Chapter IV] This matters to you only if your product falls in one of the stricter groups — the product groups guide explains how to tell.

Reporting became a live duty. Manufacturers' reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026.[Art. 71(2); Art. 14] It is the one date that has already changed what a manufacturer must do, and it reaches further back than most people expect:

Products placed on the market before 11 December 2027 fall under the essential requirements only if they are substantially modified from that date onwards, but the Article 14 reporting obligations are expressly carved out of that relief and apply to every product in scope that was placed on the market before then. From 11 September 2026 the reporting duty therefore covers a manufacturer's whole installed base, not only what it sells from now on.[Art. 69(2), 69(3)]

What to do in the first week is the practical version.

Dates still to come

Health record systems move first. Regulation (EU) 2025/327 on the European Health Data Space changes the Cyber Resilience Act in three places, and the changes take effect on 26 March 2027, before the Act's own main obligations start on 11 December 2027. All three are about electronic health record systems, and none of them changes anything for a maker outside that field. A maker of an electronic health record system shows that it meets the Act's essential security requirements through the conformity assessment in the health-data law instead of the Act's own route; it may fold the security risk assessment into the risk assessment that law already requires; and it draws up one set of technical documents covering both laws rather than two. The Act's text in the Official Journal does not show these changes and no consolidated version exists, so the Act and Regulation (EU) 2025/327 have to be read together.[Reg. (EU) 2025/327 Art. 104, amending Arts. 13(4) and 31(3) and inserting Art. 32(5a) of Reg. (EU) 2024/2847; Art. 105, which sets general application at 26 March 2027 and lists no deferral for Art. 104; OJ L, 2025/327, 5.3.2025. Note for the desk, not for buyer copy: the machinery the new Art. 32(5a) points at is EHDS Chapter III, parts of which phase in only from 26 March 2029 and 26 March 2031]

The rest of the Act applies. The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)] From that day a product placed on the EU market needs the technical documentation, a completed conformity assessment, the declaration of conformity and the CE marking. Importers and distributors start checking for them the same day.

Older certificates run out. EU type-examination certificates and approval decisions issued for cybersecurity requirements under other Union harmonisation legislation stay valid until 11 June 2028, unless they run out before then or that other legislation says otherwise.[Art. 69(1)]

The dates you set yourself

How long you support the product. The Act sets a floor and leaves the decision to you, and the date has to be printed where the buyer can see it.

The manufacturer determines the support period so that it reflects the expected time in use; it must be at least five years unless the product is expected to be used for a shorter time.[Art. 13(8), third subparagraph] The end date of the support period must be stated clearly to users at the time of purchase and in the information accompanying the product.[Art. 13(19); Annex II, point 7]

The support period guide covers how to choose it.

How long you keep the file. The manufacturer keeps the technical documentation and the EU declaration of conformity available to market surveillance authorities for at least ten years after the product is placed on the market or for the support period, whichever is longer.[Art. 13(13)]

How long updates stay available. Security updates issued during the support period must remain available for at least ten years after issue or for the remainder of the support period, whichever is longer.[Art. 13(9)]

What to have in place, and by when

Now: a way for outsiders to report a weakness to you, a named owner for reports, a first-day plan keyed to the legal clocks, and a component list for every supported release. These serve the duty that already applies.

Before the main date: the product group settled and written down, the conformity route chosen, the technical documentation built as you go rather than at the end, and the support period decided and printed. If your product is in a stricter group, the route may involve an outside body, and their calendars fill before a deadline, not after it.

The checklist

• Reporting is set up for every product in scope you have ever sold in the EU, not only new ones.
• You know which product group each product is in, and why.
• The conformity route is chosen, and the outside body booked if the route needs one.
• The technical documentation is being built release by release.
• The support period is decided and printed on the product information.
• Your file-keeping and update-retention periods are written into a procedure someone owns.

If you want help

Our scope check tells you in about two minutes whether the Act applies to your product, which duties are yours, and the dates that apply to you — free, with the article behind each answer. It is our engineering reading of the law, not a legal ruling. Every price for the work after it is on the pricing page.