fossa.comarticleFOSSA: EU CRA Compliance Timeline
A FOSSA blog post laying out the EU Cyber Resilience Act's (Regulation (EU) 2024/2847) phased compliance timeline: it entered into force 10 December 2024, vulnerability/incident reporting obligations to ENISA and national CSIRTs (including a 24-hour early warning) begin 11 September 2026, and full Annex I conformity with CE marking is required by 11 December 2027. It details what manufacturers should prioritize at each stage — CVD policy, incident-response workflows, SBOM automation, secure-by-design defaults, and conformity assessment — and promotes FOSSA's free CRA Readiness Assessment tool.
TL;DR Breaks down the EU CRA's three key compliance dates (Dec 2024, Sept 2026, Dec 2027) and what manufacturers must do before each.
Organisations named here
- ENISA
- CE marking
- EU Cyber Resilience Act
- Regulation (EU) 2024/2847
Technologies named here
- FOSSA CRA Readiness Assessment
- ENISA Single Reporting Platform
- FOSSA
- SBOM
Techniques named here
- Coordinated vulnerability disclosure policy
- 24-hour early warning reporting
- Continuous open source vulnerability monitoring
- SBOM generation
Also named here
- Annex I
Related in GRC
orca.securityarticleOrca Security: NIST AI Risk Management Framework (AI RMF) Explained
fossa.comarticleFOSSA: CISA Releases the 2026 SBOM Minimum Elements
huntress.comwriteupTeach Yourself to Phish | Huntress
