Two dates. Most people quote one.
Article 14 reporting has applied since 11 September 2026. Everything else in the Cyber Resilience Act (the security requirements, the SBOM, CE marking) applies from 11 December 2027. So if someone tells you the CRA “doesn’t start until 2027”, they’re half right, and the half they’ve got wrong is the one with a 24-hour clock on it.
No tool makes you compliant, and this isn’t legal advice. Every date below is from Article 71(2) of Regulation (EU) 2024/2847.
Not sure a product is even in scope? Run the scope check first, it’s free and takes a minute.
What applies, and from when.
Chapter IV: the certification plumbing.
Articles 35 to 51: the rules for national notifying authorities and the “notified bodies” that will assess products. It sets up who can certify what before December 2027. For a typical software vendor there’s nothing to do here.
Article 14: reporting.
If you place a product with digital elements on the EU market, you report actively exploited vulnerabilities and severe incidents affecting its security through ENISA’s Single Reporting Platform: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days of a corrective measure (one month for a severe incident). This is the one with a clock on it.
Everything else.
The essential security requirements in Annex I, vulnerability handling, technical documentation, conformity assessment and CE marking, and a machine-readable SBOM covering at least your top-level dependencies. All of it becomes enforceable on this date, for products already on the market as well as new ones.
Why does everyone get this wrong?
Because the answer is in the second sentence. Article 71(2) reads, in full:
“This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.”
Read the first sentence, stop, and you’d think there’s a year to go. There isn’t, not for reporting. The good news? Reporting is narrow. It’s actively exploited vulnerabilities and severe incidents, not every CVE in a scan. Here’s what each of the three clocks needs.
A softer landing on the first deadline. Not a free pass.
Article 64(10)(a) switches off the administrative fines for micro and small manufacturers who miss the 24-hour early warning, for an exploited vulnerability or a severe incident. That’s a real concession, and hardly anyone mentions it.
It covers the early warning and nothing else. The 72-hour notification, the final report and the duty to report at all still apply. So the practical question doesn’t change: would you know, inside a day, that something you shipped is being exploited?
Frequently asked
Does the CRA apply to us yet?
Part of it does. If you place a product with digital elements on the EU market, the Article 14 reporting duty has applied since 11 September 2026: report actively exploited vulnerabilities and severe incidents within 24 hours, 72 hours and 14 days. The rest of the regulation (security requirements, documentation, CE marking, the SBOM) applies from 11 December 2027.
People keep saying the CRA starts in December 2027. Are they wrong?
Half wrong. Article 71(2) says the regulation applies from 11 December 2027, and then, in the very next sentence, that Article 14 applies from 11 September 2026. Quote the first sentence on its own and you miss the only part with a 24-hour deadline.
Do we have to report every CVE now?
No. Article 14 covers actively exploited vulnerabilities and severe incidents affecting your product’s security, not every CVE a scanner finds. A Critical CVE nobody is exploiting isn’t reportable. A low-severity one that is being exploited is.
Is an SBOM legally required today?
Not yet. The CRA requires a machine-readable SBOM covering at least top-level dependencies, but that requirement is enforceable from full application on 11 December 2027. It’s still the fastest way to know whether an exploited package is in something you’ve shipped, which matters for Article 14 right now.
We’re a small company. Can we be fined for missing the 24-hour early warning?
No. Article 64(10)(a) says the administrative fines don’t apply to manufacturers that qualify as micro or small enterprises for missing the 24-hour early-warning deadline, for an exploited vulnerability or a severe incident. That exemption covers the early warning only. The 72-hour notification and the final report still apply, and so does everything else in Article 14.
What changed on 11 June 2026?
Chapter IV (Articles 35 to 51) started applying: the rules for notifying authorities and notified bodies, the organisations that will carry out conformity assessments. It’s groundwork for December 2027. It doesn’t put a new duty on a typical software vendor.
Does OSPulse make us CRA compliant?
No, and no tool can. OSPulse tells you when a dependency in something you’ve shipped becomes actively exploited, timestamps the moment you became aware, and builds a submission-ready pack for each Article 14 stage. Your team reviews and files it through ENISA’s Single Reporting Platform. This isn’t legal advice.
One date is already live.
Find out what you’d have to report before you have to report it.