CRA Reporting Duty Check
The Article 14 manufacturer reporting duties under the EU Cyber Resilience Act (Regulation (EU) 2024/2847) apply from 2026-09-11, ahead of full application on 2027-12-11. Check whether you are in scope, then turn the reporting deadlines into a copy-ready task list.
This self-check turns the deadline structure of Articles 14 and 16 of Regulation (EU) 2024/2847 into a task list. It is not legal advice, and it does not replace your actual notification to the competent authorities — this site files nothing on your behalf. It does not determine whether your product is an Annex III important product or an Annex IV critical product (this site's corpus does not carry those category lists), and it does not decide for you whether a situation is an "actively exploited vulnerability" or a "severe incident": that is your own factual determination, and the tool only lays out the deadlines once you have made it. If a real incident occurs, contact your legal counsel and the competent authorities immediately, and rely on the official text.
2026-09-11
Status is judged against your current date.
2027-12-11
The remaining obligations (Annex I essential requirements, conformity assessment, CE marking and so on) apply from that date; this page covers Article 14 only.
Step 1 · Are you in scope
Is your product placed on the EU market — directly, through an importer, or through a distributor?
Does the product have a direct or indirect, logical or physical data connection to a device or network (including standalone software and remote data processing solutions)?
Does the product fall into one of the categories the scope text above expressly excludes?
What is your role in this product chain?
Parallel reporting clocks
One incident may start several reporting clocks, or only one. The "who it binds" column states the precondition for each row. Whether a row applies depends on that regime's own scope; being in CRA scope does not automatically put you in any of the others.
This self-check turns the deadline structure of Articles 14 and 16 of Regulation (EU) 2024/2847 into a task list. It is not legal advice, and it does not replace your actual notification to the competent authorities — this site files nothing on your behalf. It does not determine whether your product is an Annex III important product or an Annex IV critical product (this site's corpus does not carry those category lists), and it does not decide for you whether a situation is an "actively exploited vulnerability" or a "severe incident": that is your own factual determination, and the tool only lays out the deadlines once you have made it. If a real incident occurs, contact your legal counsel and the competent authorities immediately, and rely on the official text.
The full application timeline of the Regulation
See all 8 obligations and sources2024-12-10
Regulation enters into force
Enters into force on the twentieth day following publication; obligations apply progressively at later milestones.
2026-06-11
Chapter IV on notification of conformity assessment bodies (Arts. 35-51) applies
The notification and operation rules for conformity assessment bodies apply early so that assessment capacity is in place before full application.
2026-09-11
The Article 14 manufacturer reporting obligations apply
Manufacturers must notify actively exploited vulnerabilities and severe incidents impacting product security simultaneously to the coordinating CSIRT and ENISA via the single reporting platform under Art. 16, with a 24-hour early warning, a 72-hour notification and a final report no later than 14 days after a corrective or mitigating measure is available.
2027-12-11
Regulation fully applicable
All obligations apply, including the Annex I essential cybersecurity requirements, conformity assessment, CE marking, technical documentation, support periods and vulnerability handling.
Uncertainties flagged by our corpus: Two points to watch. First, the boundaries of the Annex III important-product and Annex IV critical-product categories leave interpretive room in individual cases, and Commission technical notices and ADCO guidance are still emerging. Second, the harmonised standards conferring a presumption of conformity are not all published, so whether an Annex III class I product in practice requires a notified body depends on the standards available at the time of assessment.
Sources (1)
- Regulation (EU) 2024/2847 (Cyber Resilience Act)Official Journal of the European Union / EUR-Lex · published 2024-11-20 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.