The rest of the EU Cyber Resiliency Act lands on December 11th, 2027.

As of mid-August 2026, no Cyber Resilience Act (CRA) harmonized standards had been published in the Official Journal and no CRA-designated notified bodies were listed, but the regulation’s broad application date of December 11, 2027 remains unchanged, requiring manufacturers to meet Annex I security requirements, Article 13 duties, conformity assessment obligations, CE marking, and technical documentation requirements even without a presumption of conformity. The CRA distinguishes between product security requirements assessed when products enter the market and continuous vulnerability-handling processes throughout the support period, while Article 14 vulnerability reporting begins earlier, on September 11, 2026. Product classification, determined by core functionality rather than integrated components or marketing claims, governs whether self-assessment or third-party assessment is required, with important Class II and critical products always requiring external assessment. Manufacturers must ensure products have no known exploitable vulnerabilities, including flaws detected through their own testing, and maintain evidence-based release decisions, SBOMs, vulnerability remediation and disclosure processes, secure update mechanisms, coordinated disclosure policies, supplier due diligence, and upstream reporting practices. The text also emphasizes that support periods must reflect expected product use, security updates and compliance records may need to remain available for at least a decade, and companies should begin building documentation, testing, classification, dependency visibility, and support processes now because compliance evidence cannot be created retrospectively near the deadline.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.