Regulation (EU) 2024/2847
The CRA on one page
Timeline, categories and conformity routes, Article 14 reporting and penalties of the Cyber Resilience Act, structured as CRA App applies them to classify each product.
Timeline
| Date | What applies |
|---|---|
| 10 Dec 2024 | Entry into force of Regulation (EU) 2024/2847 |
| 11 Jun 2026 | Provisions on notified bodies (Chapter IV) |
| 11 Sep 2026 | Reporting of actively exploited vulnerabilities and severe incidents (Article 14) through the ENISA Single Reporting Platform (Article 16) |
| 11 Dec 2027 | Full application: essential requirements, conformity assessment, EU declaration and CE marking |
Categories and conformity routes
| Category | Examples from the Regulation | Route |
|---|---|---|
| Default | Most products with digital elements | Module A (internal control) or another route chosen by the manufacturer |
| Important product class I (Annex III) | Identity management systems, browsers, password managers, VPNs, network management, operating systems, routers and modems, microcontrollers with security functions | Module A if harmonised standards, common specifications or European certification (assurance level substantial or higher) are applied in full; otherwise B+C or H |
| Important product class II (Annex III) | Hypervisors, firewalls, intrusion detection and prevention systems, tamper-resistant microprocessors and microcontrollers | B+C or H with a notified body, or European certification (assurance level substantial or higher) |
| Critical product (Annex IV) | Hardware devices with security boxes, smart meter gateways, smartcards | European certification where required; otherwise as class II |
The technical description of each category is in Implementing Regulation (EU) 2025/2392.
Reporting (Article 14)
| Deadline | Actively exploited vulnerability | Severe incident |
|---|---|---|
| 24 hours | Early warning | Early warning |
| 72 hours | Notification | Notification with initial assessment |
| Final report | Within 14 days after a corrective or mitigating measure is available | Within one month after the notification |
Reports are submitted through the ENISA Single Reporting Platform and addressed to the coordinating CSIRT of the Member State where the manufacturer has its main establishment.
Penalties (Article 64)
| Breach | Maximum |
|---|---|
| Annex I essential requirements and obligations under Articles 13 and 14 | €15M or 2.5% of total worldwide annual turnover, whichever is higher |
| Other obligations of manufacturers, importers, distributors and bodies | €10M or 2%, whichever is higher |
| Incorrect, incomplete or misleading information to bodies or authorities | €5M or 1%, whichever is higher |
Micro and small enterprises are not fined for missing the 24-hour early-warning deadline, nor are open-source software stewards (Article 64(10)).
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex
- Implementing Regulation (EU) 2025/2392, EUR-Lex
- Machinery Regulation (EU) 2023/1230, EUR-Lex
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- European Commission: Cyber Resilience Act
- ENISA, European Union Agency for Cybersecurity
Consulted on 6 Nov 2026.
This page summarises the Regulation for guidance on classification. It does not constitute legal advice or certification. Conformity is declared by the manufacturer and, where the CRA requires it, a notified body is involved.