Cyber Resilience Act (CRA) › Chapter VIII — Transitional and final provisions 1 EU type-examination certificates and approval decisions issued regarding cybersecurity requirements for products with digital elements that are subject to Union harmonisation legislation other than this Regulation shall remain valid until 11 June 2028, unless they expire before that date, or unless otherwise specified in such other Union harmonisation legislation, in which case they shall remain valid as referred to in that legislation.
2 Products with digital elements that have been placed on the market before 11 December 2027 shall be subject to the requirements set out in this Regulation only if, from that date, those products are subject to a substantial modification.
3 By way of derogation from paragraph 2 of this Article, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027.
In practice Meroi Security’s note, not part of the regulation
The transitional rule is narrower than it looks, because it runs per product. The FAQ, following the Blue Guide, states that CRA obligations attach to individual products; a product type carries none of its own. Only individual units placed on the market before 11 December 2027 escape, and units manufactured after that date to a non-compliant type cannot be placed on the market. Article 69(2) exempts pre-2027 products unless they are substantially modified from that date; Article 69(3) removes the Article 14 reporting obligations from that exemption entirely.
Source: Commission services FAQ v1.4 (4 Sep 2026) §1.4, §7.2
Guides on this provision Cyber Resilience Act Cybersecurity Risk Assessment: Article 13 and Annex I in Practice How to carry out the CRA cybersecurity risk assessment: scope, intended and foreseeable use, Annex I applicability, residual risk, components and updates. Cyber Resilience Act SBOM Requirements: Building a Usable Component Inventory Understand Cyber Resilience Act SBOM requirements, dependency coverage, formats, sharing and how to use component inventories in vulnerability handling. Cyber Resilience Act Support Period Requirements Determine and document a Cyber Resilience Act support period, including product lifetime, supplier dependencies, software versions and update availability. Cyber Resilience Act Technical Documentation: Building the Evidence File Prepare Cyber Resilience Act technical documentation with an Annex VII evidence checklist, product-version traceability, review steps and retention requirements. EU Cyber Resilience Act Product Classification: Categories and Conformity Routes Cyber Resilience Act product classification: Annex III and IV categories, core functionality, conformity routes and when a notified body is needed. EU Cyber Resilience Act Reporting Requirements: Article 14 and the SRP Understand CRA Article 14 reporting triggers, 24-hour and 72-hour notifications, final reports, CSIRT routing and practical reporting preparation. Need help applying this in practice?
Reading the regulation is the easy part. We help manufacturers work out
what it means for a specific product, and what evidence a notified body
will expect.
CRA compliance services
Source and currency. Text of Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements, reproduced from
EUR-Lex
(CELEX 32024R2847) as at 16 August 2026. © European Union,
1998–2026. Reuse is authorised under
the EUR-Lex legal notice .
Includes the corrigenda published
in the Official Journal on 2 July 2025 and 17 October 2025 .
Only the Official Journal of the European Union is authentic and produces
legal effect. This reader is provided for convenience and does not
constitute legal advice.
