Cyber Resilience Act: which documents manufacturers need and which deadlines apply

Three dates

Art. 71(2) sets the dates. The Commission names the reporting and main dates again with its guidance of 27 July 2026.

• 11 June 2026: Chapter IV on notifying authorities and notified bodies (Art. 35 to 51)
• 11 September 2026: manufacturer reporting duties (Art. 14), for all products in scope
• 11 December 2027: everything else, including the software bill of materials

Who this applies to

Products with digital elements made available on the market whose intended or foreseeable use includes a direct or indirect data connection to a device or network (Art. 2(1)). That can be software, a connected device or a machine with a control unit and data link. Certain products with their own rules, such as medical devices, are excluded (Art. 2(2)).

Products placed on the market before 11 December 2027 only fall under the other duties if substantially modified (Art. 69(2)). The reporting duties apply to them regardless (Art. 69(3)).

Which documents you need from 11 December 2027

• Technical documentation before placing on the market, at least with the content of Annex VII (Art. 13(12), Art. 31)
• Including: general description, design and vulnerability handling processes, risk assessment, basis of the support period, standards applied, test reports, a copy of the declaration
• EU declaration of conformity under Annex V (Art. 28), with the product as a copy or as a simplified declaration under Annex VI with the exact internet address (Art. 13(20))
• Information and instructions for users under Annex II, on paper or electronically (Art. 13(18))
• End date of the support period, at least month and year, clearly stated at purchase (Art. 13(19))
• Software bill of materials in a commonly used machine-readable format, at least for top-level dependencies (Annex I Part II point 1)

When the software bill of materials applies

Sources give different dates. The text is clear: Art. 71(2) only brings forward Art. 14 and Chapter IV. The SBOM sits in Annex I Part II, so it applies from 11 December 2027. The Regulation does not require publishing it. If you make it available to users, you say where (Annex II point 9). A market surveillance authority gets it on reasoned request (Annex VII point 8). The Commission may specify format and elements by implementing act (Art. 13(24)).

What should be on record since 11 September 2026

You report actively exploited vulnerabilities and severe incidents through the single reporting platform: early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a fix is available for vulnerabilities, within one month for incidents (Art. 14(2) and (4)). According to the Commission, the platform has been live since 11 September 2026.

So keep a record of who reports, when you became aware and what you reported. Under the guidance you need not report vulnerabilities whose active exploitation you already knew about before 11 September 2026. How to handle vulnerabilities technically is not the topic of this page.

How long to keep them

Technical documentation and declaration: at least ten years after placing on the market, or for the support period, whichever is longer (Art. 13(13)). The same goes for user information (Art. 13(18)). The support period is at least five years, unless the product is expected to be in use for less (Art. 13(8)). Importers keep a copy of the declaration for as long (Art. 19(6)).

Where companies stand

ENISA surveyed small and medium-sized enterprises in 2026 (194 responses from 31 countries and regions, which ENISA says is not representative). 66 % had heard of the CRA before the survey. 42 % reported limited or no understanding of the required documentation. More than 70 % asked for technical documentation templates.

What to do now

• Check per product whether a data connection exists and the CRA applies.
• Name who reports through the platform and record the times.
• Set the support period per product and justify it.
• Build the outline of the technical documentation from Annex VII.
• Plan for the declaration and user information to sit at a fixed address.

Frequently asked questions