Implement
The CRA is already on the clock
Why September 2026, not December 2027
Most summaries lead with full application in December 2027. That is the wrong date to plan against.
The obligation that arrives first is vulnerability and incident reporting under Article 14, from 11 September 2026, and it reaches products already on the market. The companion piece, CRA essentials, sets out what in-scope actually demands.
Knowing the date is one thing. Being ready for what it triggers is another.
Read: CRA essentials