When did the reporting obligations start?
The CRA reporting obligations under Art. 14 apply to manufacturers of products with digital elements from 11 September 2026.
In accordance with Art. 71(2) of the CRA, the reporting obligations for open-source software stewards under Art. 24(3) apply from 11 December 2027.
Mandatory notifications must be submitted through the CRA Single Reporting Platform. See FAQ 25 for information on what to do if the platform is temporarily unavailable.
© 2026
European Union Agency for Cybersecurity (ENISA)
• ENISA legal notice
• "All you need to know about the CRA SRP"
•
Disclaimer
Disclaimer: This FAQ is subject to the legal notice published on ENISA's website. Its content was extracted from ENISA's web page when this website was built; please check the original page for accuracy.