Sources
Everything the scope check and the generator say about the law comes from these texts, read on 24 October 2026. Where this site and the regulation differ, the regulation wins.
- Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024. EUR-Lex. Used: Articles 2, 3, 6, 7, 8, 13, 14, 18 to 22, 27, 28, 30, 31, 32, 33, 64, 69, 71; Annexes I to VIII; recitals 9, 11, 12, 15, 16, 18, 20.
- Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 on the technical description of the categories of important and critical products with digital elements, OJ L, 2025/2392, 1.12.2025, in force. EUR-Lex. Used for the category questions of the scope check.
- Commission Communication C(2026) 5252 of 27 July 2026, "Communication on the Cyber Resilience Act (CRA) guidance", with its annex "Commission guidance on the application of the Cyber Resilience Act". Commission library page. Non-binding; cited for scope of apps and app stores (section 2, example 3), software updates as substantial modifications (section 4.3), support period (section 5), core functionality (section 6.1) and remote data processing (section 8).
- European Commission CRA policy page, digital-strategy.ec.europa.eu: application dates and the statement that mobile applications follow the default route.
Dates (Article 71 and Article 69)
- Entry into force: 10 December 2024.
- Chapter IV (notification of conformity assessment bodies): 11 June 2026.
- Article 14 reporting obligations: 11 September 2026, also for products already on the market (Article 69(3)).
- All other obligations: 11 December 2027; products placed on the market before that date come in when substantially modified (Article 69(2)).
Open points on the day of reading
- No implementing act yet for the simplified technical-documentation form for micro and small enterprises (Article 33(5)).
- No implementing act yet for the SBOM format (Article 13(24)); CycloneDX JSON is used as a commonly used, machine-readable format.
- No harmonised standard references checked against the Official Journal; the generator maps to Annex I directly (Annex VII point 5).