EU CRA deadlines
The compliance clock is fixed and already running. Here is every date that matters, and what it means for a manufacturer.
The CRA enters into force
Regulation (EU) 2024/2847 became law. The obligations do not all apply immediately — but the countdown to each application date starts here. This is when planning should have begun.
Clock startedNotified-body provisions apply
The rules governing conformity-assessment bodies (notified bodies) take effect, so that the certification infrastructure exists before manufacturers need it for important and critical products.
In effectVulnerability & incident reporting applies
Manufacturers must report actively exploited vulnerabilities and severe incidents on a tight clock: an early warning within 24 hours, a fuller notification within 72 hours, and a final report once resolved — to ENISA and the relevant national CSIRT. For most manufacturers this is the nearest-term obligation, arriving well before the full market gate.
Next major deadlineFull obligations apply — the market gate
From this date, an in-scope product with digital elements cannot be lawfully placed on the EU market without meeting the Annex I essential requirements, carrying a CE mark and EU Declaration of Conformity, and having a complete Annex VII technical file. Non-compliance risks fines up to €15 million or 2.5% of worldwide annual turnover.
Market access gateReporting duties arrive first, the market gate later — so a vulnerability-handling program is the most urgent build for most manufacturers. See how the reporting clock works in the CRA Briefings, and where to start overall in the OT/ICS manufacturer guide.
Source: Regulation (EU) 2024/2847 — application dates (Article 71); Article 14 (reporting); Article 64 (penalties). Dates verified against the published regulation.
Behind on the clock? Start with the file.
The CRA Workbench turns your product profile into a reviewer-ready Annex VII package and vulnerability-handling program — the two things these deadlines demand.
See the CRA Workbench →This timeline is general information about Regulation (EU) 2024/2847, not legal advice. Dates are verified against the published regulation, but confirm against the current official text before relying on any point. The CRA Workbench is software that produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.