CRA knowledge base

Transition period

What applies from when – and how are existing products and distributors affected?

← Back to the FAQ overview

All questions in this topic

When does the CRA start applying?

In stages: rules on notifying bodies (Art. 35–51) from 11 June 2026, reporting obligations (Art. 14) from 11 September 2026, and the remaining requirements incl. CE from 11 December 2027.

Source: European Commission · FAQ 7.1 Official EU FAQ (original text)

Can a product type developed before the CRA continue to be manufactured identically afterwards?

The CRA applies to individual products, not types. Only individual units placed on the market before 11 December 2027 are exempt – identical units placed afterwards must comply.

Source: European Commission · FAQ 7.2 Official EU FAQ (original text)

During the transition, may products integrate components without CE marking?

Yes. Components without CE marking (incl. open source) may be integrated, provided the manufacturer exercises due diligence so they do not compromise cybersecurity.

Source: European Commission · FAQ 7.3 Official EU FAQ (original text)

May important/critical components be integrated that do not follow harmonised standards?

Yes. Harmonised standards are only one way to demonstrate conformity, not an obligation. Such components may be integrated – regardless of whether standards are available.

Source: European Commission · FAQ 7.4 Official EU FAQ (original text)

Must distributors bring products placed on the market before 11 December 2027 into compliance?

No. Such existing products are not subject to the CRA (except the reporting obligations) unless substantially modified. Distributors need not retrofit them.

Source: European Commission · FAQ 7.5 Official EU FAQ (original text)

Topic blocks

Summarised and translated from the European Commission’s “FAQs on the Cyber Resilience Act” (v1.2, 16 January 2026), licensed under CC BY 4.0. Simplified by Lehner & Szecsey – the original text prevails. Official EU FAQ (original text).