CRA Deadline December 2027 — What You Need to Comply

Key numbers

11 Dec 2027

full enforcement — all obligations under the CRA apply from this date

11 Sept 2026

Article 14 reporting starts — vulnerability notifications to ENISA within 24 hours

documents CRACheck generates per product to cover the documentation layer

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Now: classify your products

Determine whether each product is default, Important Class I/II (Annex III), or Critical (Annex IV). This determines the conformity assessment path and timeline for any third-party assessment.

Now: assess vulnerability handling readiness

Article 14 applies from 11 September 2026. You need a CVD policy, a contact address for vulnerability reporting, and the capacity to submit early warning notifications to ENISA within 24 hours.

Q3 2026: establish ENISA reporting capability

Familiarise yourself with the single reporting platform under Article 16. Prepare the notification templates for early warning (24h), vulnerability notification (72h), and final report (14 days).

Q4 2026–Q2 2027: build the documentation

Draw up technical documentation per Article 31 and Annex VII. Conduct the cybersecurity risk assessment per Article 13(2)–(3). Prepare the EU declaration of conformity per Article 28.

Q3 2027: complete conformity assessment

For default products, Module A. For Important Class I without harmonised standards, Module B+C or H. For Class II, Module B+C or H per Article 32(3).

Before 11 December 2027: affix CE marking

Per Article 30, CE marking may only be affixed after the conformity assessment procedure is complete.

From 11 December 2027: maintain compliance

Ongoing security updates per Part II, point (8) of Annex I, vulnerability handling per Part II, and support period obligations per Article 13(8) for a minimum of five years.

Common mistakes

❌

DATES

"Ignoring the September 2026 reporting deadline"

Article 14 applies from 11 September 2026, sixteen months before full enforcement. From that date, manufacturers must notify actively exploited vulnerabilities to ENISA within 24 hours, submit a vulnerability notification within 72 hours, and deliver a final report within 14 days. Missing this intermediate deadline is a separate violation.

❌

GRANDFATHERING

"Assuming products already on the market are exempt"

Article 69(1) states that products placed on the market before 11 December 2027 are subject to the CRA only where they undergo a substantial modification after that date. However, Article 13(8) and Part II of Annex I still apply during the support period for vulnerability handling.

❌

TIMELINE

"Leaving documentation to the last quarter before enforcement"

Article 13(12) requires technical documentation to be drawn up before placing the product on the market. For Important Class I/II products, Article 32(2)–(3) requires third-party examination, which adds months. Starting in Q4 2027 risks missing the deadline.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

First step in any compliance timeline. Determines whether you need Module A or third-party examination, which directly impacts how far in advance you need to start.

Technical Documentation

Per Article 31 and Annex VII. The central document that must exist before market placement. Starting early means you have time to iterate.

Risk Assessment

Per Article 13(2) and (3). Maps your product against Part I of Annex I. Must be updated during the support period.

User Information

Per Annex II. Nine mandatory items that must accompany the product at market placement.

Declaration of Conformity

Per Article 28 and Annex V. Cannot be issued until the conformity assessment is complete.

CVD Policy

Required from 11 September 2026 for Article 14 compliance. Starting early is not optional for this document.

Notification Template

Article 14 structure. Operational from 11 September 2026. Must be in place before the first vulnerability is discovered.

Obligations Calendar

Maps the three enforcement dates, your product's support period, and documentation retention requirements (10 years per Article 13(13)) onto a single timeline.

Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 WAIT AND REACT

€20,000+ (rush rates)

No cost now, but €15M maximum fine per Article 64(2) after December 2027. Scramble to hire a consultant in Q4 2027 when every firm is booked. No time for notified body examination if product is Class I/II.

✓ CRACHECK

€149

€149 one-time. Documentation ready in 15–25 min. 30 days to refine before filing. Time buffer for notified body if needed. Regenerate when the regulation or your product evolves.

Two layers

● LAYER 1

The documentation and declaration layer

Technical documentation per Annex VII, cybersecurity risk assessment per Article 13, declaration of conformity per Annex V, user information per Annex II. All of this must exist on the date you place your product on the market after 11 December 2027.

∅ LAYER 2

Security updates, vulnerability handling, ENISA reporting

The CRA is not a one-time compliance event. Article 13(8) imposes a minimum five-year support period. Part II of Annex I requires continuous vulnerability handling. Article 14 requires real-time notification to ENISA. These are ongoing operational obligations that no documentation tool replaces.

Build the documentation layer now. Use the time between now and December 2027 to build the operational capabilities the CRA demands.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Essential requirements + manufacturer obligations (Art. 64(2))

€15,000,000 / 2.5%

Breach of Annex I or Articles 13/14 — applies from 11 December 2027 (Art. 13) and 11 September 2026 (Art. 14).

🟠

Documentation and conformity obligations (Art. 64(3))

€10,000,000 / 2%

Breach of Art. 31, Art. 28, Art. 32 — applies from 11 December 2027.

🟡

Misleading information (Art. 64(4))

€5,000,000 / 1%

Misleading information to authorities.

Alternatives

Criterion	Wait until Q4 2027	Start with consultant now	Start with templates now	CRACheck now
Risk of missing deadline	Maximum	Low, but expensive	Medium — incomplete	Low — full Annex VII
Cost	Premium rush rates later	€10K–€20K now	Staff time	€149 now
Art. 14 readiness (Sept 2026)	Not covered	May be included	Not covered	CVD + ENISA template included
Time to first draft	Months (if consultant available)	8–16 weeks	Weeks	15–25 minutes

Multiple products to prepare before December 2027?

Each product needs its own documentation set. Volume pricing: €99 per product (10-pack) or €79 per product (30-pack). Start early, document all products.

Request Volume Pricing

Generate now, refine as needed, regenerate when the regulation updates.

What CRACheck guarantees and what it does not

CRACheck generates a structured document based on Article 31 and Annex VII of Regulation (EU) 2024/2847 from the data you provide. You are responsible for the accuracy of that data as the manufacturer.

We guarantee that the document structure follows Article 31 and Annex VII and that all legal references are correct. We do not guarantee acceptance by any specific market surveillance authority or notified body.

CRACheck is not legal advice. For company-specific compliance strategy, consult a specialised regulatory lawyer.

Frequently asked questions

Does the CRA apply to products I placed on the market before 11 December 2027?

Article 69(1) states that products placed on the market before 11 December 2027 are subject to the CRA only if they undergo a substantial modification after that date. However, vulnerability handling obligations under Part II of Annex I and Article 14 reporting still apply during the support period.

What exactly must I have ready by 11 September 2026?

Article 14 applies from that date. You need: a coordinated vulnerability disclosure policy (Part II, point (5) of Annex I), a contact address for vulnerability reports (Part II, point (6)), and the capacity to submit early warning notifications to ENISA within 24 hours (Article 14(2)(a)).

Is 15 months enough to prepare for full enforcement?

For default-category products using Module A self-assessment, the documentation can be completed in days. For Important Class I/II products requiring notified body examination, the process can take 3–6 months. Starting now is advisable for any product that may need third-party assessment.

Can I generate the documentation now and update it later?

Yes. CRACheck includes 30 days of editing and 10 regenerations per licence. The technical documentation must be continuously updated during the support period per Article 31(2). You can generate a first version now and refine it as your product evolves.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Per Article 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate with the updated version at no additional cost during licence validity.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act (full text)

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.

Regulation (EU) 2024/2847 applies from 11 December 2027. Article 14 reporting obligations start on 11 September 2026. If you place a product with digital elements on the EU market, here is what you need, in what order, and how CRACheck covers the documentation layer.