What is settled, and what is not
Generated from the Facts Table on every release, so it cannot drift from the facts a verdict cites. Facts v2026.09.2, released 3 September 2026.
This Facts Table has not yet been counter-checked by a human against the Official Journal text.
Every entry carries its Article reference so you can verify it yourself, and the checker is free precisely so that you can.
| Fact | Kind | As of | Source |
|---|---|---|---|
| Regulation (EU) 2024/2847 entered into force on 10 December 2024. | Date | 3 September 2026 | Art. 71(1) |
| Article 14 (reporting obligations of manufacturers) applies from 11 September 2026. | Date | 11 September 2026 | Art. 71(3) |
| The Regulation applies in full from 11 December 2027. | Date | 11 December 2027 | Art. 71(2) |
| Actively exploited vulnerability: early warning within 24 hours of awareness; notification within 72 hours; final report within 14 days after a corrective or mitigating measure is available. | Timeline | 3 September 2026 | Art. 14(1)–(2) |
| Severe incident having an impact on the security of the product: early warning within 24 hours; incident notification within 72 hours; final report within one month after the incident notification. | Timeline | 3 September 2026 | Art. 14(3)–(4) |
| The European Commission approved practical guidance for manufacturers and businesses on 27 July 2026; formal adoption pending translations as of the facts date. | Status | 3 September 2026 | Commission |
| No harmonised standards for the CRA have been cited in the Official Journal as of the facts date; standardisation deadlines were proposed to move by about two months (July 2026 draft amendment). | Status | 3 September 2026 | Commission / CEN-CENELEC |
| Notified bodies for the CRA are being designated; the Commission targets sufficient capacity by December 2026 (best efforts). | Status | 3 September 2026 | Commission |
| ENISA single reporting platform: onboarding of Assigned Representatives began 31 July 2026; the platform was in testing in late August 2026 and is to be operational for 11 September 2026. | Status | 3 September 2026 | ENISA |
| The EU SECURE programme co-funds micro, small and medium enterprises up to EUR 30,000 for CRA readiness activities; first call ran 28 January–29 March 2026. | Status | 3 September 2026 | Digital Europe Programme |
| Commission Implementing Regulation (EU) 2025/2392 provides technical descriptions of the Annex III and Annex IV product categories (in force 21 December 2025); the class matcher uses those descriptions, not shorthand labels. | Status | 3 September 2026 | Implementing Regulation (EU) 2025/2392; Art. 7(4) |
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 3 September 2026 (Facts v2026.09.2). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.