Cyber Resilience Act timeline
CRA application dates sit in Article 71 of Regulation (EU) 2024/2847
Direct answer. Article 71 of Regulation (EU) 2024/2847 (Cyber Resilience Act) says the regulation enters into force on the twentieth day following publication in the Official Journal, applies from 11 December 2027, and then carves out earlier application: Article 14 from 11 September 2026 and Chapter IV (Articles 35 to 51) from 11 June 2026. Verify every date against the live Art. 71 text on EUR-Lex. Corrigenda or later amendments may exist. This page is not legal advice.
CRALedger Duty Records (Shopify App Store · Write a review) tracks product roles, checklists and open record gaps, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records. It does not file notifications on ENISA’s platform. This page is the Art. 71 date reading aid — not the Article 14 clock walkthrough and not a role determination.
Related: EUDR Records Manager — DDS reference numbers on supplier lots.
Free check first: CRA role and scope self-check runs in your browser and sends nothing. Describe a product and your role and see which articles of Regulation (EU) 2024/2847 to read.
Checklist: confirm Art. 71 before you diary a date
- Open the live Regulation (EU) 2024/2847 on EUR-Lex and read Article 71, not this paraphrase.
- Check whether EUR-Lex shows a corrigendum or a later consolidated version that changes Art. 71.
- Treat 11 December 2027 as the general application date only if the live article still says so.
- Treat 11 June 2026 as the Chapter IV (Arts. 35–51) date only if the live article still says so.
- For Article 14 clocks, use CRA Article 14 incident deadlines instead of repeating those hours here.
What Art. 71 says, as published
The Official Journal copy of Regulation (EU) 2024/2847 (OJ L, 2024/2847, 20.11.2024) includes this Article 71 wording:
- Art. 71(1): the regulation enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.
- Art. 71(2): the regulation applies from 11 December 2027. However, Article 14 applies from 11 September 2026 and Chapter IV (Articles 35 to 51) applies from 11 June 2026.
EUR-Lex’s own summary of the act repeats those application dates. Publication in the OJ on 20 November 2024 is what Art. 71(1) counts from; do not treat a twentieth-day calculation on this page as a substitute for the Official Journal record. If a corrigendum later changes Art. 71, the EUR-Lex text controls.
What this timeline page does not repeat
Article 14’s 24-hour, 72-hour, and later report clocks are a different job. They are walked on Track CRA Article 14 incident deadlines on the product file. This page only points at when Art. 71 says Article 14 starts to apply. Duty-file work before an incident sits on CRA duty records.
What this page is not
- Not legal advice, a role determination, or an ENISA filing service.
- Not a substitute for the live Art. 71 text, including any corrigendum.
- Not a repeat of the Article 14 incident-clock walkthrough.
Related pages
- CRA role and scope self-check — see which articles to read
- CRA duty records before an Article 14 incident
- CRA Article 14 incident deadlines — the clocks, not the Art. 71 calendar
- CRALedger Duty Records — live App Store listing
- Regulation (EU) 2024/2847 on EUR-Lex
- Shopify apps hub
- Tools
Not legal advice. Confirm Article 71 on EUR-Lex, including any corrigenda, before you treat a date as in force. The app tracks records you enter; it does not file ENISA notifications.