📋 Tender Overview
Error 500 (Server Error)!!1500.Thats an error.There was an error. Please try again later.Thats all we know.The Cyber Resilience Act (CRA) entered into force on December 10, 2024, and its main provisions will apply on December 11, 2027. The regulation establishes a single regulatory framework for hardware and software products with digital elements and defines cybersecurity requirements throughout their lifecycle.
The CRAs core obligations apply to manufacturers of products with digital elements. Among other things, they include assessing cyber risks, meeting essential cyber security requirements, dealing with vulnerabilities, preparing technical documentation and determining product support periods.
Reporting obligations from 11 September 2026
From September 11, 2026, manufacturers will have to report on:
actively exploited vulnerabilities of products with digital elements;
serious incidents affecting the safety of products with digital elements.
The CRA sets out a multi-step reporting process. The manufacturer must submit the early warning within 24 hours and the report within 72 hours. It must also submit a final report, the deadline for which depends on whether it is an actively exploited vulnerability or a serious incident.
The reporting obligations also apply to products with digital elements that were made available on the European Union market before the main provisions of the CRA came into force on 11 December 2027.
A single reporting platform
Reporting will take place via the Single Reporting Platform (in English) (Single Reporting Platform - SRP), established by the European Union Agency for Cyber Security (ENISA).
From 11 September 2026, the SRP platform will be used by manufacturers and CSIRTs to implement reporting obligations. The platform will also enable voluntary reporting by natural and legal persons.
Preparations for the full use of the CRA
The CRAs main obligations come into force on 11 December 2027. Manufacturers will need to ensure product compliance with essential cybersecurity requirements, conduct cyber risk assessments and effectively address vulnerabilities. They will also have to carry out an appropriate conformity assessment procedure before placing the product on the market.
On 27 July 2026, the European Commission published guidelines to support the timely implementation of the CRA (in English). Among other things, the guidelines explain in more detail the scope of the regulation, remote data processing solutions, free and open source software, significant product changes, support periods, reporting obligations and risk assessment requirements.
Key dates
December 10, 2024 - entry into force of the CRA;
11 June 2026 - entry into force of provisions on notification of conformity assessment bodies;
September 11, 2026 - the reporting obligation starts to apply;
11 December 2027 - the main provisions of the CRA come into force.
