Which CRA Requirements Are Already in Force in 2026?

The CRA Is in Force, but That Does Not Mean Every Requirement Applies

The first distinction to make is between entry into force and application. Regulation (EU) 2024/2847 entered into force on 10 December 2024, so the Cyber Resilience Act is already part of EU law. Article 71 nevertheless gives different provisions different application dates. The Regulation generally applies from 11 December 2027, while Chapter IV began applying on 11 June 2026 and Article 14 began applying on 11 September 2026. This matters when a business asks whether the CRA is already in force. The accurate answer is yes, but that does not mean every manufacturer obligation, Annex I requirement, conformity route, importer duty or distributor duty is already applicable. Current compliance analysis should identify the exact provision and its application date rather than relying on one general CRA effective date.

• 10 December 2024: the Regulation entered into force.
• 11 June 2026: Chapter IV began applying.
• 11 September 2026: Article 14 began applying.
• 11 December 2027: the Regulation generally becomes applicable.

Chapter IV Has Applied Since 11 June 2026

Chapter IV contains Articles 35 to 51 and deals with the notification and operation of conformity assessment bodies. It covers the authorities responsible for notification, requirements that notified bodies must meet, the notification process, changes to notifications, operational obligations, information duties and coordination. Its early application allows the institutional conformity assessment system to develop before the main CRA product obligations become applicable. The date should not be interpreted as meaning that all manufacturers had to complete CRA conformity assessment on 11 June 2026. The legal change concerns Chapter IV itself. For manufacturers preparing products for the 2027 regime, however, the development of this assessment infrastructure is operationally important because some product classifications and conformity routes can require third-party involvement.

Article 14 Reporting Has Applied Since 11 September 2026

Article 14 is the most significant CRA obligation already applicable directly to manufacturers in September 2026. It requires manufacturers to notify specified actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements. The notifications are made through the Single Reporting Platform developed and operated by ENISA. This does not create a requirement to report every vulnerability or every operational security event. The manufacturer first needs to determine whether the facts meet the regulatory trigger. When Article 14 does apply, the Regulation uses staged reporting with an early warning generally required within 24 hours and further information required within defined later periods. Product-security teams therefore need a process that can identify possible CRA reporting events quickly enough for legal and technical assessment.

• Article 14 applies to specified reporting events.
• The obligation currently applies to manufacturers.
• Reporting is carried out through the Single Reporting Platform.
• The first reporting deadline can arise within 24 hours of awareness.

Most CRA Product Requirements Are Not Yet Generally Applicable

The early 2026 dates should not be expanded into a claim that all CRA product-security requirements are already mandatory. The Regulation generally applies from 11 December 2027. That later application includes the main framework for manufacturer obligations, essential cybersecurity requirements, vulnerability handling, product information, technical documentation, economic-operator responsibilities and the conformity requirements that apply to products placed on the Union market under the CRA regime. Businesses should nevertheless work on those areas before the legal application date because product development and certification cycles can be long. A product intended to remain commercially relevant after December 2027 may require architecture, documentation, support-period, component-management and conformity decisions well before the deadline.

• Annex I readiness should be developed before 2027 even where the obligation is not yet generally applicable.
• Technical documentation should be built with the product rather than assembled at the deadline.
• Product classification can affect the conformity route and preparation time.
• Supply-chain roles should be mapped before market placement decisions are made.

What Manufacturers Should Already Have Working in 2026

For manufacturers within CRA scope, the immediate 2026 priority is the reporting workflow. The organisation needs a route from vulnerability discovery or incident detection to product identification, technical triage and regulatory assessment. Staff who receive vulnerability reports should know how to escalate a potentially actively exploited vulnerability. Incident-response teams should be able to determine whether a product-security event may meet the Article 14 definition of a severe incident. Legal, compliance and product-security owners need access to the information required for staged notifications. The process should also preserve evidence of when the manufacturer became aware of the relevant facts because the statutory time periods are linked to awareness. This operational work can coexist with the broader 2027 readiness programme rather than being treated as a separate compliance exercise.

• Define internal Article 14 escalation ownership.
• Record awareness times and affected product versions.
• Connect technical response with regulatory reporting.
• Maintain access to the ENISA Single Reporting Platform.
• Continue the wider December 2027 readiness programme.

What Other Economic Operators Need to Understand in 2026

Importers, distributors and other supply-chain actors should not assume that Article 14 gives them the same manufacturer reporting obligation from September 2026. Article 14 is framed as a reporting obligation of manufacturers. Other economic-operator duties under the CRA form part of the broader framework that generally applies from December 2027. That does not make 2026 irrelevant to those businesses. Importers and distributors can use the transition period to identify products, manufacturers, contractual contacts and evidence flows that will matter once their own obligations apply. Where a business may become a manufacturer because of branding, product modification or another legal circumstance, role analysis becomes especially important. The current phase is therefore both an active reporting period for manufacturers and a preparation period for the wider supply chain.

• Do not apply manufacturer reporting duties automatically to every supply-chain actor.
• Identify the legal economic-operator role product by product.
• Prepare evidence and escalation routes before December 2027.
• Review own-brand and product-modification scenarios carefully.

A Practical 2026 CRA Status Checklist

A useful 2026 CRA status review begins by separating what applies today from what is being prepared for 2027. Confirm whether the organisation is a manufacturer of potentially covered products and whether Article 14 reporting procedures are operational. If the business participates in conformity assessment, review the Chapter IV framework that has already entered application. For the wider product portfolio, continue scope analysis, product classification, cybersecurity risk assessment design, Annex I mapping, technical documentation planning and vulnerability-handling preparation. Record each workstream with its legal basis and application date. This prevents the two opposite errors that frequently appear in CRA planning: assuming nothing matters until December 2027, or assuming the entire CRA became applicable during 2026.

• Separate current obligations from future obligations.
• Operate Article 14 reporting where applicable.
• Track Chapter IV conformity infrastructure.
• Prepare product and economic-operator controls for December 2027.
• Use official EU and ENISA material for current implementation status.