What is settled, and what is not
Generated from the Facts Table on every release, so it cannot drift from the facts a verdict cites. Facts v2026.09.4, released 10 September 2026.
| Fact | Kind | As of | Source |
|---|---|---|---|
| Regulation (EU) 2024/2847 entered into force on 10 December 2024. | Date | 10 September 2026 | Art. 71(1) |
| Article 14 (reporting obligations of manufacturers) applies from 11 September 2026. | Date | 11 September 2026 | Art. 71(2) |
| The Regulation applies in full from 11 December 2027. | Date | 11 December 2027 | Art. 71(2) |
| Actively exploited vulnerability: early warning within 24 hours of awareness; notification within 72 hours; final report within 14 days after a corrective or mitigating measure is available. | Timeline | 10 September 2026 | Art. 14(1)–(2) |
| Severe incident having an impact on the security of the product: early warning within 24 hours; incident notification within 72 hours; final report within one month after the incident notification. | Timeline | 10 September 2026 | Art. 14(3)–(4) |
| The European Commission published its first set of practical guidance on the application of the Regulation on 27 July 2026 (non-binding guidance under Article 26). | Status | 10 September 2026 | Commission |
| No harmonised standards for the CRA have been cited in the Official Journal as of the facts date; the Commission’s standardisation request M/606 covers 41 standards, with the first deliverables expected in Q3 2026. | Status | 10 September 2026 | Commission / CEN-CENELEC |
| Notified bodies for the CRA are being designated; the Commission targets sufficient capacity by December 2026 (best efforts). | Status | 10 September 2026 | Commission |
| ENISA single reporting platform: the Assigned Representative guidance pages (user registration; notification submission and update; interface functions) were updated on 9 September 2026, alongside guidance on particularly exceptional circumstances under the third subparagraph of Article 16(2), an AR user manual, an SRP glossary, terms and conditions and the list of CSIRTs designated as coordinators; from 11 September 2026 manufacturers are required to submit Article 14 notifications through the platform. | Status | 10 September 2026 | ENISA |
| The EU SECURE programme co-funds micro, small and medium enterprises up to EUR 30,000 for CRA readiness activities; first call ran 28 January–29 March 2026. | Status | 10 September 2026 | Digital Europe Programme |
| Commission Implementing Regulation (EU) 2025/2392 provides technical descriptions of the Annex III and Annex IV product categories (in force 21 December 2025); the class matcher uses those descriptions, not shorthand labels. | Status | 10 September 2026 | Implementing Regulation (EU) 2025/2392; Art. 7(4) |
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.