The EU Cyber Resilience Act has two deadlines. September 11, 2026 activates Article 14 incident reporting. December 11, 2027 is the bigger one: mandatory CE marking and a formal conformity assessment under Annex I for every in-scope product, following one of three assessment paths depending on your product's risk tier.
Nearly every CRA explainer written in the run-up to September 2026 leads with the reporting deadline, because it's imminent and it's a hard date with a clock attached. That's the right emphasis for this month. It is not the regulation's largest obligation.
Accuracy note: every date and classification below is cross-checked against Article 71 of Regulation (EU) 2024/2847 (application dates) as published on EUR-Lex, the European Commission's CRA conformity assessment policy page, and the Commission's plain-language CRA summary. If you're making a compliance or product-classification decision from this article, verify against the current regulation text and Annexes for your specific product — this is not legal advice.
What Changes on December 11, 2027
Which assessment path applies to your product — self-assessment, or mandatory third-party review by a notified body — depends on which of three product tiers it falls into, covered in detail below.
From December 11, 2027, the CRA's full essential cybersecurity requirements under Annex I apply to every in-scope product with digital elements placed on the EU market, and manufacturers must affix the CE marking to demonstrate conformity before that happens. This is the CRA's main compliance date under Article 71's staged application schedule — the one the regulation was fundamentally built around — and it's separate from, and much broader than, the September 2026 reporting obligation covered in our CRA Day One runbook.
Unlike the reporting obligation, which applies the moment the clock strikes, the CE-marking requirement applies to products placed on the market from that date forward. Products already on the EU market before December 11, 2027 that comply with existing applicable law can generally continue to be made available without the full CRA conformity-assessment package, subject to the regulation's specific transition provisions — another area where your product's exact situation should be checked against the text rather than a general summary.
The Three Conformity Assessment Tiers
Not every product goes through the same assessment path. The CRA sorts products with digital elements into three tiers, and which tier yours lands in determines whether self-assessment is enough or a notified body has to sign off.
Default category. Most products — the CRA's own examples include things like standard mobile apps, memory chips, and general consumer software — can use self-assessment. The manufacturer assesses its own product against Annex I and issues an EU declaration of conformity, without third-party involvement, regardless of which specific technical standard it used to demonstrate conformity.
Important products (Annex III). Products with more direct security relevance — the regulation's own examples include password managers, firewalls, and VPN clients — are split into two classes. Class I products can generally still be self-assessed if the manufacturer applies a relevant harmonized European standard; without one, or for Class II products, assessment by a notified body becomes mandatory.
Critical products (Annex IV). The smallest, highest-risk category — examples include smart cards, secure elements, and smart meter gateway components — requires notified-body involvement in every case. There's no self-assessment path for this tier.
If you don't know which tier your product falls into, that classification question — not the deadline itself — is usually the first thing worth resolving, since it determines how much lead time you need for a notified-body assessment versus a self-assessment you control the timeline of.
Why "Notified Body" Matters for Your Timeline
A notified body is an independent conformity-assessment organization designated by an EU member state to evaluate products against a regulation's requirements — the CRA equivalent of a certification lab. As of mid-2026, the CRA's rules for how notified bodies get designated had started applying, but the pool of actually-designated bodies was still filling in. If your product falls into Annex III Class II or Annex IV, that's a capacity constraint worth planning around well before late 2027: a third-party assessment queue is not something you can compress by starting later.
SBOM: From "Nice to Have" to Formal Requirement
Software Bill of Materials generation is good practice today — the concept predates the CRA, formalized in the US by NTIA's 2021 minimum-elements definition — and becomes a documented expectation under the CRA's Annex I essential requirements from December 2027 — manufacturers need to know, and be able to demonstrate, what's in their product. Our SBOM requirements checklist and SBOM and the EU CRA cover the practical mechanics: formats (CycloneDX, SPDX), what fields matter, and how to generate one automatically rather than by hand. GeekWala's free SBOM generator produces both formats from a manifest with no signup required.
Vulnerability disclosure and handling processes — not just the one-time September 2026 reporting workflow, but an ongoing vulnerability-handling policy — are also part of the Annex I essential requirements manufacturers need in place by December 2027, not something to build in the weeks before.
Compliance readiness isn't limited to vulnerabilities, either. Annex I documentation expectations sit alongside the separate, non-regulatory obligation of knowing what you're legally permitted to do with each dependency's license — see our dependency license compliance guide for that side of the audit.
The CRA also isn't the only EU regime building on the same SBOM-and-vulnerability-management evidence chain. Financial entities in scope for DORA's ICT third-party risk articles and essential or important entities under NIS2's supply chain security requirements can largely reuse the same inventory, scanning, and reporting groundwork described here instead of building a separate compliance track per regulation.
Preparing Now: A Practical Checklist
- Classify your product against Annex III and Annex IV. If it doesn't match either list, you're likely in the default self-assessment category — confirm that conclusion against the regulation text, don't assume it.
- If you're in Annex III Class II or Annex IV, start researching notified-body capacity now. Third-party assessment queues do not compress on demand.
- Stand up automated SBOM generation across your build pipeline, not a one-time manual export — see the SBOM checklist for the full list.
- Document your vulnerability-handling process — how you receive, triage, and remediate vulnerability reports — as a standing policy, not an incident-response improvisation.
- Don't let the September 2026 reporting deadline crowd out December 2027 planning. They're different obligations with different scope, and the second one requires materially more lead time to prepare for.
Frequently Asked Questions
Is December 11, 2027 the same deadline as the September 2026 reporting obligation?
No — they're different obligations under the same regulation. September 11, 2026 activates Article 14's 24/72-hour/14-day vulnerability and incident reporting duty, covered in our reporting deadline guide. December 11, 2027 activates the full essential cybersecurity requirements and mandatory CE marking. Meeting one does not satisfy the other.
Does every software product need a notified body's sign-off?
No. Most products fall into the default category and can be self-assessed by the manufacturer. Only "important" products in Annex III Class II and "critical" products in Annex IV require mandatory third-party assessment; Annex III Class I products can often still be self-assessed if a relevant harmonized standard applies. Confirm your product's specific classification against Annexes III and IV rather than relying on this general summary.
What happens if my product is already on the EU market before December 2027?
The regulation includes transition provisions for products already placed on the market that comply with existing applicable law — but the specifics depend on your product and when it shipped. This is a case where checking the regulation's transition articles directly, or getting counsel involved, matters more than a general blog summary.
This article is an engineering-oriented compliance explainer, not legal advice. Product classification and conformity-assessment decisions should be verified against Regulation (EU) 2024/2847 and, where the stakes justify it, your own counsel.
Need your SBOM groundwork in place before the notified-body queue fills up? Generate a free SBOM or scan your dependencies — no account required.
