EU Cyber Resilience Act: Preparing for December 11, 2027 | Endor Labs

What it is

An Endor Labs walkthrough of what applies on 11 December 2027, when the whole EU Cyber Resilience Act (CRA) takes effect. The useful content is the state of play as of mid-August 2026, the route per product tier, and the Article-level retention and relief rules. The post links to a separate one on the 11 September 2026 reporting deadline.

Current state (mid-August 2026, per the page)

• No CRA harmonized standards are published in the Official Journal, so the Article 27 presumption of conformity is unavailable.
• NANDO lists no CRA-designated notified bodies, so a third-party assessment can't be booked yet.
• The date does not move. You may meet Annex I directly and record in the technical documentation how you did it.

How the tiers route

Tier is set by core functionality: the one feature without which the product couldn't meet its purpose. Integration is not classification. A router with an integrated firewall is still a router, and a smartphone shipping an OS doesn't take on OS core functionality. Inconsistent marketing material can't be used to reach a milder regime.

flowchart TD
    A[Core functionality] --> B{Tier}
    B -->|Default| C[Self-assessment]
    B -->|Important I| D{Harmonised standard<br/>applied in full?}
    D -->|Yes| E[Module A self-assessment]
    D -->|No standard yet| F[Third-party route]
    B -->|Important II / Critical| G[Third-party, always]
    B -->|FOSS, Class I/II| H[Default procedures, Art 32 5]

Class I self-assessment is therefore not open today. A standard does not unlock self-assessment for Class II or critical products. Modules of a suite that are also sold separately are classified individually, and the guidance's example puts a SIEM, intrusion detection and analytics modules in three different tiers. Category descriptions are in Implementing Regulation (EU) 2025/2392.

Obligations the summary only gestures at

• Annex I Part I is assessed when you place the product on the market. Part II is assessed throughout the support period. Building Part II for the September reporting duty covers much of the December work.
• Art 13(9): each security update stays available for at least 10 years after issue, or for the rest of the support period if longer.
• Art 31: technical documentation and the declaration of conformity are kept for 10 years or the support period, whichever is longer.
• Art 13(19): the support end date must be visible at purchase, to month and year at minimum.
• Art 13(10): you may patch only the latest version if users can upgrade at no additional cost. The guidance reads "additional costs" narrowly, meaning mandatory hardware or infrastructure replacement, not staff time, testing or configuration work.
• Art 13(6): report vulnerabilities to the maintainer of the component you actually integrated, following their process. You need not duplicate a known advisory or report to an unmaintained project.
• Support period: five years is a floor. A blanket five years is attackable if the product is evidently used longer.
• Product families: variants share one risk assessment, documentation set and declaration if architecture, security-relevant design, intended purpose and risk exposure match. Different interfaces, software stacks or update mechanisms split a family.

What to do

• Write one sentence per product ("without X, this product cannot meet its purpose") and classify X against Annex III/IV and Regulation 2025/2392.
• Decide deliberately whether separately sold modules should stay separate, given their individual classification.
• Read the ETSI EN 304 6xx drafts for your category. Their inquiries close between mid-September and mid-November 2026, so some have closed. Comments go through your national standardization body.
• Build Annex I evidence directly, and group variants into families now.
• Keep a coverage matrix once a standard is cited. The presumption reaches only as far as the standard, and the Art 13(2) risk assessment stays mandatory.

Caveats

• The legacy-product relief (paragraph 124 of the guidance) limits obligations to modified parts when the original manufacturer substantially modifies a pre-December-2027 product. The author calls it the most exposed reading: it stretches Art 22(2), and the guidance binds neither courts nor market surveillance authorities. Document the assessment if you rely on it.
• The page is not legal advice, and classification should go to counsel.
• The Endor Labs figures (92% fewer findings, the 192-vulnerability AI SAST benchmark, 6x faster remediation) are vendor claims.