Implementing the Cyber Resilience Act: Duties, Deadlines, Evidence

The deadlines, and what falls due at each

The CRA entered into force on 10 December 2024 and takes effect through staggered dates. Since 11 September 2026 the reporting obligations for manufacturers have applied. Full application follows on 11 December 2027.

Products placed on the market before 11 December 2027 generally fall under the full duties only upon a substantial modification. The reporting obligations, however, also apply to products already made available.

Two pillars that are often confused

The CRA requires product properties and lifecycle duties. Both sit in Annex I, and both are poorly met in practice, in different ways.

The support period is neither a recommendation nor a guide figure. Under Article 13(8) third subparagraph it is at least five years; only a shorter expected product lifetime takes the place of that minimum. The determination is also bound: the second subparagraph requires it to reflect the expected use, taking account of users' expectations and the nature of the product. Security updates provided remain available under Article 13(9) for at least ten years or for the remainder of the support period, whichever is longer. Technical documentation and the EU declaration of conformity must be kept under Article 13(13) for at least ten years or for the duration of the support period, whichever is longer. And the period is not an internal figure: Article 13(19) requires the end date to be stated at the point of purchase in an easily accessible, clear and understandable way, giving at least the month and the year. Where technically feasible, users must also be shown a notice once that end is reached.

Reporting is separate from both. Vulnerability handling is a standing duty, reporting is an event duty. The same PSIRT function should serve both, but they are different processes.

The reporting chain, with the deadlines from Article 14

Reports go SIMULTANEOUSLY to the CSIRT designated as coordinator and to ENISA, through the single reporting platform under Article 16. Not to one body that passes it on to the other. Two triggers: actively exploited vulnerabilities, and severe incidents affecting the security of the product.

• 24 hoursEarly warning, without undue delay and in any event within 24 hours of the manufacturer becoming aware. Brief, but not empty: for vulnerabilities it names the member states in whose territory the product was, to the manufacturer's knowledge, made available; for incidents at least whether unlawful or malicious action is suspected, and where applicable those member states as well.
• 72 hoursNotification, without undue delay and in any event within 72 hours of becoming aware, covering the product concerned, the general nature of the exploit or incident, and the corrective or mitigating measures taken.
• 14 daysFinal report for an actively exploited vulnerability, at the latest 14 days after a corrective or mitigating measure becomes available.
• one monthFinal report for a severe security incident, counted from the 72-hour notification.

Beyond reporting to the authorities, Article 14(8) requires manufacturers to inform the affected users and, where applicable, all users about the incident or vulnerability, where necessary including the mitigating and corrective measures users can take themselves, and where appropriate in a structured, machine-readable format. Reporting to the CSIRT does not replace that. If the manufacturer fails to inform users in time, the CSIRTs designated as coordinators may do so themselves.

A company can be a manufacturer under the CRA and an operator under NIS-2 at the same time, and in the financial sector fall under DORA as well. The duties overlap; they do not replace one another. Without a clear boundary you get either a double report with contradictory content or a reporting gap, because everyone relies on the other regime.

Does our ISO 27001 certificate cover the CRA?

No, and the line is clear: between process and product, between management system and product law. The frameworks interlock rather than replace one another.

The consequence of a gap differs accordingly: under the CRA lawful market access falls away, because CE marking hangs on conformity. Under NIS-2 supervision steps in with orders and fines under the BSIG. What is proven at process level carries the product law duties of the CRA. It does not replace them. What is new in the CRA is above all the tie to placing on the market, conformity assessment with an EU declaration of conformity and CE marking, a defined support period, the mandatory SBOM and statutory reporting deadlines for product vulnerabilities.

What OdySecure contributes, and what it does not

We provide the specialist assessment. The legally binding determination of whether and how the CRA applies to a particular product stays with a law firm.