Regulation (EU) 2024/2847
Understand your EU Cyber Resilience Act obligations
Free, traceable guidance for manufacturers, importers, and distributors placing products with digital elements on the EU market. Every claim cites the regulation.
Next statutory date
Art. 14 reporting obligations are now in force
01 / Operator paths
Start with your role
The CRA assigns different obligations depending on your position in the supply chain.
Manufacturer
You design, develop, or produce products with digital elements placed on the EU market.
App developer
You develop an app — mobile, desktop, or smart TV — placed on the EU market. You're a manufacturer under the CRA.
Importer
You place products from non-EU manufacturers on the EU market under your own name.
Distributor
You make products with digital elements available on the EU market without altering them.
Open-source steward
You systematically provide free/open-source software intended for commercial use.
Authorised representative
You are EU-established and hold a written mandate to act on behalf of a non-EU manufacturer.
02 / Time horizon
Regulatory deadlines
Art. 14 vulnerability reporting obligations apply from 11 September 2026.
View full timeline →11 / 09 / 2026
11 September 2026 — Vulnerability reporting obligations apply
Article 14 vulnerability and incident reporting to ENISA becomes mandatory. This is the first hard deadline. Manufacturers must have their reporting processes in place before this date.
11 / 12 / 2027
11 December 2027 — Full regulation applies
All CRA requirements apply to all in-scope products. No new products may be placed on the EU market that do not conform.
03 / Evidence standard
Traceable. Independent.
Every obligation, classification, and scenario on this site traces back to the regulation text or official guidance. No vendor sponsors influence how we interpret the law.
01Article-level citations
Every obligation links to the exact regulation article. No unverified summaries.
02Confidence badges
Content is tagged Binding, Draft guidance, or Interpretive — so you know what is law.
03Legal + tech review
Obligation pages require sign-off from a named legal reviewer and a named technical reviewer.