When does the CRA apply?
It depends
It depends on which obligation. The Regulation entered into force on 10 December 2024, Article 14 reporting obligations apply from 11 September 2026, and the Regulation applies in full from 11 December 2027 [[F-001]] [[F-002]] [[F-003]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Article 14 reporting | Applies from 11 September 2026 | — | F-002 |
| Full application | From 11 December 2027 | — | F-003 |
| Already on the EU market before 11 December 2027 | Full requirements only on substantial modification | Full requirements apply from placing on the market | F-004 |
| Substantial modification after 11 December 2027 | Full requirements apply from then | Legacy status continues | F-014 |
Check your own product
Start the short scope check. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
New product launching in March 2027
Likely in scope · role: _
Reporting obligations apply from launch; the full requirements apply from 11 December 2027.
Deciding fact: Art. 3(1), Art. 2(1)
-
New product launching in June 2028
Likely in scope · role: _
Placed on the market after full application: reporting and full requirements both apply from launch.
Deciding fact: Art. 3(1), Art. 2(1)
-
Product already on the market since 2023
Likely in scope · role: _
Reporting from 11 September 2026; full requirements only on substantial modification after 11 December 2027.
Deciding fact: Art. 3(1), Art. 2(1)
-
Product not available in the EU
Likely out of scope · role: _
Not made available on the EU market: no clock runs.
Deciding fact: Art. 3(22)
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
Three dates
Regulation (EU) 2024/2847 entered into force on 10 December 2024 [1]. Article 14, the manufacturer reporting obligations for actively exploited vulnerabilities and severe incidents having an impact on the security of the product, applies from 11 September 2026 [2] [3]. The Regulation applies in full from 11 December 2027 [4].
Two clocks per product
The scope result names two separate clocks. Reporting under Article 14 runs from 11 September 2026 or from the date the product is first placed on the market, whichever is later [2]. Full requirements and CE marking run from 11 December 2027 or from placing on the market, whichever is later [4].
Legacy products
Products placed on the market before 11 December 2027 are subject to the full requirements only if substantially modified after that date, while reporting obligations apply to them regardless [5]. A substantial modification is a change affecting compliance with the essential requirements or modifying the intended purpose [6].
Getting your own dates
Answer the optional market-position step in the scope check and the result computes both clocks for your product from these facts [2] [4] [5].
Timing
Article 14 reporting applies from 2027-03-01; full requirements and CE marking apply from 2027-12-11. Dates come from the Facts Table entries cited below, evaluated for the first example; run the check for your own product's dates.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-001 Regulation (EU) 2024/2847 entered into force on 10 December 2024. Art. 71(1) EUR-Lex ↩
- F-002 Article 14 (reporting obligations of manufacturers) applies from 11 September 2026. Art. 71(2) EUR-Lex ↩
- F-030 Actively exploited vulnerability (Art. 3(42)): reliable evidence that a malicious actor has exploited it in a system without the system owner's permission. A severe incident having an impact on the security of the product (Art. 14(5)) is one that negatively affects or is capable of negatively affecting the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or that has led or is capable of leading to the introduction or execution of malicious code. Art. 3(42), Art. 3(44), Art. 14(5) EUR-Lex ↩
- F-003 The Regulation applies in full from 11 December 2027. Art. 71(2) EUR-Lex ↩
- F-004 Products placed on the market before 11 December 2027 are subject to the Regulation only if substantially modified after that date; Article 14 applies to them regardless. Art. 69(2)–(3) EUR-Lex ↩
- F-014 Substantial modification: a change after placing on the market affecting compliance with essential requirements or resulting in a modification of the intended purpose; a person who substantially modifies a product becomes its manufacturer. Art. 3(30), Art. 22 EUR-Lex ↩
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-101 Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.