The timeline
The dates
| Date | What applies | What it means for you |
|---|---|---|
| 23 October 2024 | Adoption | — |
| 20 November 2024 | Publication in the OJEU | Clocks start |
| 10 December 2024 | Entry into force | The text is final; there will be no renegotiation |
| 11 June 2026 | Chapter on notification of conformity assessment bodies | Notified bodies may be designated → book a slot for class II and Critical products |
| 11 September 2026 | Reporting obligations (Art. 14), including for products already on the market | 24 h / 72 h / 14 d procedure operational, on-call rota, tested channel, ready templates, documented escalation rule |
| 11 December 2027 | Full application | CE marking, technical documentation, essential requirements, SBOM, support period, user information |
The transitional regime
Two rules, the second a derogation from the first.
General rule. Products placed on the market before 11 December 2027 are subject to the Regulation only if they are subsequently substantially modified.
Derogation. The Article 14 reporting obligations apply to all products within scope, including those placed on the market before that date.
In other words:
| Legacy portfolio (before 11/12/2027) | New products (from 11/12/2027) | |
|---|---|---|
| CRA CE marking | No, unless substantially modified | Yes |
| Technical documentation | No, unless substantially modified | Yes |
| SBOM in the file | No, unless substantially modified | Yes |
| Support period | No, unless substantially modified | Yes |
| 24 h / 72 h / 14 d reporting | Yes, since 11/09/2026 | Yes |
A security update fixing a vulnerability, with no other change, is not a substantial modification and therefore does not push a legacy product into the full regime.
The internal back-planning
Derived from the legal dates, to be approved by the committee and reviewed quarterly.
Immediately — the costliest delays
- Contract notified bodies for all class II and Critical products. It is the only item whose lead time is not yours to control.
- Arm the reporting procedure, if that is not done: the deadline has passed.
- Classify the portfolio: without it, you do not know which products need the first item.
24 months before full application
Complete portfolio classification, assessment routes chosen, governance and RACI approved, licence policy settled.
18 months before
SBOM automated across 100 % of build chains; centralisation platform in production; continuous monitoring active.
12 months before
CVD policy published, security.txt online, first disclosure cycle handled, security
advisories published in machine-readable form.
9 months before
Complete technical documentation for two representative pilot products — one default, one important — to test the process before industrialising it.
6 months before
Dry-run audit, third-party review, gap closure, timed reporting exercise.
3 months before
EU declarations of conformity signed, CE marking affixed, Annex II notices shipped, ten-year archiving configured and tested by an actual retrieval.
What can still move
Three matters remain open and must be tracked:
- the publication and OJ citation of the harmonised standards arising from request M/606, which conditions self-assessment of class I products;
- the Commission’s delegated and implementing acts — updating Annexes III and IV, SBOM format, mandatory certification of critical products;
- the designation of national authorities and the practical arrangements of the single reporting platform.
None of these three can move the Regulation’s dates. They can, however, change the route to them, particularly for class I.