CRA essentials: what being in scope actually demands
Knowing you're in scope is step zero. What in-scope asks of the product is where it gets concrete, and where most teams find the work they hadn't costed.
An RS Strategy publication
You are not (really) late. The law simply keeps moving.
Insights reads Europe's digital regulation the way you have to live it: already in force, and different in every country it touches. A strange place to stand, and the right one if one of these texts has found its way to you.
What's moving, in order
A handful of the dates that reach you first. The tracker holds the rest.
Today · 20 Jul 2026
Aug 202612 days
CRA harmonised standards: Type A principles and Type B vulnerability handling expected from CEN/CENELEC/ETSI.
2 Aug 202613 days
AI Act obligations for high-risk systems apply.
11 Sep 202653 days
CRA vulnerability and incident reporting begins, including for products already on the market (Art 69(3)).
Oct 2027438 days
Delivery deadline for the generic product-security standard, six weeks before full application.
11 Dec 2027509 days
CRA full application.
By member state
NIS2 binds you on your country's transposition, not the EU date.
Start from your question
Featured
Three ways to go further
Who this is for
- Security leads who have to operationalise these texts.
- General counsel and legal departments tracking obligations that differ across borders.
- Product and compliance teams inside manufacturers now in CRA scope.
- Policy and public-affairs people reading Brussels before it becomes law.
If one of these is already on your desk, you know where to start.
Work with RS Strategy