Acuna GRC core
ComplyFrameworks, scopes and cross-mapping.ImplementRequirements, measures and controls.OperateRisks, tasks, annual plan, documents.AssureKPIs, audits and corrective actions.
Platform overview
Add-on modules
TPRM (Supplier Shield)Supplier assessments and a daily grade.Data PrivacyProcessing activities, DPIAs and requests.Cookie ManagerCookie banner and consent records.Trust CenterAnswer questionnaires, share a trust page.AI GovernanceRegister and assess your AI systems.EvaluationsSpot checks and gap assessments.Group managementSubsidiaries in one Group Compliance view.Staff PortalPolicies staff read and acknowledge.Vulnerability managementScanner results turned into issues.
All modules
Across the platform
AikoThe AI assistant, at your pace.Integrations and APIConnectors, task sync, webhooks, API.Administration and securityUsers, access profiles, audit log.100+ connectors
By size
StartupGet ready for your first audit.Mid-marketKeep the library clean as you grow.EnterpriseControl at scale.Consultants and MSSPsAll your clients in one view.
By framework
ISO 27001ISO 42001NIS2EU AI ActDORASOC 2GDPRNIST CSFSwiss FADPFINMA
See all frameworks
By need
Prepare for a certification auditAnswer a client questionnaireRun compliance across a groupAssess your suppliersGovern your AI systems
All solutions
Acuna GRC Services
Do it yourselfYou run the program in Acuna GRC, with Aiko.Done with you (Co-managed)Guidance, reviews and audit preparation with your team.Done for you (Fully managed)Our experts run it. You review.
What we take on
CISO as a serviceDPO as a serviceAudit preparationGap assessmentsProgram setup in Acuna GRC
Meet the experts
Alexis HirschhornCertified Lead AuditorLaura MenetreyLegal and privacy expertBénédicte SévinISO 27001 Lead Implementer
Meet the full team
MSSPs and consultants
Acuna GRC for MSSPsWhite label and tenant managementBecome a partner expert
Learn
BlogWebinarsAnswersGlossary
See all resources
Framework guides
ISO 27001NIS2DORAEU AI ActCyber Resilience Act
All frameworks
Featured
WebinarFrom AI hype to AI reality: governing the AI your company already usesView the webinarGuideHigh-risk AI systems: how the EU AI Act classifies yoursRead the guide
Company
About AcunaTeamPricingOur Trust CenterContact us
Legal
PrivacyTermsData Processing AgreementAcuna GRC AI information
Our own standard
ISO/IEC 27001:2022 certifiedThe standard you ask of your own suppliers.Built and run from SwitzerlandHosted in Switzerland, the EU or the US.
Cyber Resilience Act

What is the Cyber Resilience Act timeline?

By Alexis Hirschhorn, CEO, AcunaLast updated 16 July 20262 min read

Direct answer

The Cyber Resilience Act entered into force on 10 December 2024. Reporting obligations start on 11 September 2026 and the bulk of the requirements — secure design, vulnerability handling, SBOM, CE marking — apply from 11 December 2027. Products already on the market before that date do not need a new conformity assessment unless they undergo a substantial modification.

Key takeaways

  • 10 December 2024: Regulation enters into force (Art. 71).
  • 11 June 2026: Framework for notifying conformity-assessment bodies applies (Chapter IV).
  • 11 September 2026: Reporting obligations start — 24h early warning, 72h notification, 14-day final report to ENISA and national CSIRT (Art. 14).
  • 11 December 2027: All essential requirements, SBOM, conformity assessment and CE marking apply.
  • Legacy trap: products placed on the market before 11 December 2027 do not need a new conformity assessment unless they undergo a substantial modification — but the Article 14 reporting obligation applies from 11 September 2026 to all products currently in use across the EU, including legacy systems shipped before the CRA existed.
  • Penalty tiers: up to EUR 15 million or 2.5 % of worldwide turnover for breaches of Annex I or Articles 13 and 14 (Art. 64).
Watch · 1 min

When Does the Cyber Resilience Act Apply? The Only 2 Dates You Need

Watch on YouTube ↗

The full answer

The CRA is already law. It entered into force on 10 December 2024 and its obligations roll out in three stages (Art. 71):

DateMilestone
10 December 2024Regulation enters into force
11 June 2026Framework for notifying conformity-assessment bodies applies (Chapter IV)
11 September 2026Reporting obligations apply (Art. 14): 24-hour early warning · 72-hour notification · 14-day final report
11 December 2027Full application: all essential requirements and manufacturer obligations

The 11 September 2026 date is the most immediate. From that day, manufacturers must report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform. Critically, this obligation reaches back to products already on the EU market -- it is not limited to products first placed on the market after the CRA. A legacy device that predates the regulation is still subject to the reporting duty if it is actively exploited on or after 11 September 2026. This is the "legacy trap": teams that treat the 2027 conformity deadline as the real start line risk being caught by the earlier reporting obligation on products they consider out of scope.

The 11 December 2027 deadline covers everything else: secure by design, vulnerability-handling process, SBOM, technical documentation, conformity assessment, EU declaration of conformity and CE marking. A product placed on the market before 11 December 2027 does not require a full CRA conformity assessment unless it undergoes a substantial modification that changes its risk profile. The reporting duty from September 2026 reaches back regardless.

For a product team, the practical sequence is: build the detection and 24-hour escalation process first (it arrives first and covers legacy products), then run the classification and conformity-assessment work for the 2027 deadline.

How Acuna GRC handles it

Sources

  1. CRA Article 71 (entry into force and application)
  2. CRA Article 14 (reporting obligations)
  3. European Commission -- CRA implementation

This page explains the rules in general terms and is not legal advice.

See how Acuna GRC runs this.

Tell us your frameworks and your team. We show you how Acuna GRC runs the program.

Hosted in Switzerland, the EU or the US