11 September 2026: reporting duty for actively exploited vulnerabilities and severe incidents (Art. 14). In force now.
11 December 2027: everything else, meaning essential requirements, SBOM, technical documentation, conformity assessment, CE marking, support period (Art. 71(2)).
Products placed on the market before 11 December 2027 are not subjected to the full requirements unless they undergo a substantial modification after that date. The exception is Article 14: Art. 69(3) extends the reporting duty to products placed on the market before the application date. So an existing product is exempt from the paperwork but not from reporting.
"Substantial modification" is the phrase to watch. A major version that changes the product's intended purpose or affects compliance with the essential requirements can pull an old product into the full regime.
From December 2027, each product needs a defined support period during which vulnerabilities are handled effectively. It must be at least five years, or the expected use time if that is shorter (Art. 13(8)), and the reasoning behind it goes into the technical documentation (Annex VII, point 4).
Technical documentation and the EU declaration of conformity must be kept at the disposal of authorities for at least ten years after the product is placed on the market, or for the support period, whichever is longer (Art. 13(13)).
Three tiers under Art. 64: up to €15M or 2.5% of worldwide turnover for the essential requirements and the Article 13–14 obligations; up to €10M or 2% for other obligations; up to €5M or 1% for supplying incorrect information to authorities. Member States set and enforce the actual penalties, with due regard to the size of microenterprises, SMEs and start-ups.
As of this writing, no amendment has moved either date. The EU's simplification initiatives have discussed streamlining but have not changed the CRA's application timeline. Plan on the dates as written.
Two free tools that apply this to your case: the 2-minute applicability check (does the CRA apply to you, with the clauses) and the SBOM generator (CycloneDX + SPDX from your manifest, signed). No signup for either.
Sources, primary only: Regulation (EU) 2024/2847 — EUR-Lex · European Commission — CRA summary · European Commission — CRA reporting · ENISA — Single Reporting Platform. Not legal advice; the regulation text controls.