Implementation of the CRA Regulation in the EU Member States
The CRA Regulation applies directly in all Member States and does not need to be transposed. Each Member State must, however, adopt some national measures: designate the market surveillance authorities and the authority that notifies conformity assessment bodies, lay down penalties and organise the CSIRT that receives reports. For each Member State: the national act (or bill), the designated authorities and a link to the source.
Since 11 September 2026, vulnerabilities and incidents are reported through ENISA’s single reporting platform to the CSIRT designated as coordinator under NIS 2, including in Member States that have not yet adopted their own measures.
Measures in force: 3 · Partial measures in force: 2 · Bill before parliament: 3 · Draft in preparation: 6 · No measure identified: 13 · Download the table (CSV)
Notifying authority: Federal Chancellery (Bundeskanzleramt). Market surveillance: to be designated.
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · The Federal Chancellery states that the notifying authority sits within it and that the other competences will be set in the coming months through implementing rules; no bill has been published yet.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Manufacturers' reports go to the coordinating CSIRT designated under NIS 2.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Manufacturers' reports go to the coordinating CSIRT designated under NIS 2.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing act identified. The National Cyber Security Centre (NCSC-HR) has stated that it is the coordinating CSIRT for reports.
Notifying authority and, in future, market surveillance: Digital Security Authority (within the Office of the Commissioner of Communications), according to the Commissioner. Reports: the Authority's national CSIRT.
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · In an article published on 23 September 2026 on the Digital Security Authority's website, the Commissioner of Communications stated that the Authority acts as notifying authority and will act as market surveillance authority, while its national CSIRT receives manufacturers' reports. No published act setting out these powers or the penalties has been identified.
Návrh zákona o požadavcích na kybernetickou bezpečnost výrobků s digitálními prvky Draft act on cybersecurity requirements for products with digital elements Official source (opens in a new tab)
Notifying authority and reports: NÚKIB. Market surveillance: existing sectoral authorities (for example the Czech Trade Inspection Authority).
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · The Ministry of Industry and Trade sent the draft to inter-ministerial consultation on 3 July 2026. It sets out offences for economic operators and notified bodies, with fines of up to €15 million or 2.5% of worldwide turnover, and would mostly apply from 11 December 2027.
Udkast til forslag til lov om supplerende bestemmelser til forordningen om cyberrobusthed Draft act on provisions supplementing the Cyber Resilience Regulation Official source (opens in a new tab)
Under the draft: notifying authority, market surveillance and national coordination by Styrelsen for Samfundssikkerhed (Danish Resilience Agency); the AI market surveillance authorities for products that are high-risk AI systems; DANAK assesses conformity assessment bodies. Reports: national CSIRT (Centre for Cyber Security).
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · The Ministry of Resilience and Preparedness put the draft to public consultation from 5 October to 2 November 2026. It provides for fines for breaches of the regulation, criminal liability of legal persons and a five-year limitation period; the proposed entry into force is 1 March 2027, but the rules on market surveillance and penalties would apply from 11 December 2027.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Manufacturers' reports go to the coordinating CSIRT designated under NIS 2.
Market surveillance, notifying authority and reports: Traficom (National Cyber Security Centre NCSC-FI).
1 June 2026
10 milestones, 5 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
1 June 2026 · National act enters into force National (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
Notes · First Member State with a complete implementing law. It provides for administrative fines of up to €15 million or 2.5% of worldwide turnover; breaches of the reporting obligations can be fined from 11 September 2026.
Notifying authority and CSIRT: ANSSI. Market surveillance: ANFR with ANSSI's technical support, according to the ministry (not yet set by an act).
12 October 2026
11 milestones, 6 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
9 October 2026 · National act adopted National (passed)
12 October 2026 · National act enters into force National (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · The decree only governs the procedure for notifying conformity assessment bodies, entrusted to ANSSI. Rules on market surveillance and penalties are still missing.
Gesetz zur Durchführung der Verordnung (EU) 2024/2847 über horizontale Cybersicherheitsanforderungen für Produkte mit digitalen Elementen (Cyberresilienz-Verordnung) Act implementing Regulation (EU) 2024/2847 (Cyber Resilience Act) BT-Drs. 21/6134 Official source (opens in a new tab)
Market surveillance, notifying authority and CSIRT for reports: Federal Office for Information Security (BSI).
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · Government bill tabled on 26 May 2026 and passed by the Bundestag on 15 October 2026, amended only as regards entry into force (Interior Committee recommendation, BT-Drs. 21/8622); the Bundesrat stage (its next plenary sitting is set for 20 November 2026) and promulgation are still to come. It amends the BSI Act (BSIG) and lays down the procedure for fines. The provisions on notifying conformity assessment bodies and on reporting enter into force the day after promulgation, since the references to 11 June and 11 September 2026 have lapsed; the rest, including market surveillance, from 11 December 2027.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Manufacturers' reports go to the coordinating CSIRT designated under NIS 2.
2025. évi CXXXV. törvény az Európai Unió kiberrezilienciáról szóló rendeletének magyarországi végrehajtásáról és egyes kiberbiztonsági rendelkezések módosításáról Act CXXXV of 2025 on the implementation in Hungary of the EU Cyber Resilience Regulation and amending certain cybersecurity provisions Magyar Közlöny 2025/158 Official source (opens in a new tab) · Database entry
Market surveillance and notifying authority: Supervisory Authority for Regulatory Affairs (SZTFH).
6 January 2026
11 milestones, 6 already passed
10 December 2024 · Regulation enters into force EU (passed)
10 December 2025 · National act adopted National (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
6 January 2026 · National act enters into force National (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
Notes · Implementing law that also amends the Cybersecurity Act (Act LXIX of 2024), in force since 6 January 2026. The rules on notifying bodies apply from 11 June 2026, those on market surveillance and fines from 11 December 2027 (fines from HUF 500,000 up to the regulation's maximums, i.e. €15 million or 2.5% of worldwide turnover; no fines on budget-funded public bodies).
Reports: National Cyber Security Centre (NCSC). Market surveillance and notifying authority: to be designated.
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · On 11 September 2026 the NCSC published national guidelines on reporting. There is no bill yet; the 2030 national strategy plans the law on authorities and penalties by the end of 2027.
Schema di decreto legislativo recante disposizioni per l'adeguamento della normativa nazionale al regolamento (UE) 2024/2847 (regolamento sulla ciberresilienza) Draft legislative decree aligning national law with Regulation (EU) 2024/2847 (Cyber Resilience Act) Atto del Governo n. 447 Official source (opens in a new tab)
Under the draft: notifying and market surveillance authority is the National Cybersecurity Agency (ACN), which may rely on the Guardia di Finanza; the national accreditation body assesses and monitors conformity assessment bodies; the AI authorities cover products that are also high-risk AI systems; Banca d'Italia, CONSOB and IVASS cover the entities they supervise; the Data Protection Authority acts within its remit. Consumer reports: CSIRT Italia.
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · Draft legislative decree under the delegation in Article 15 of the 2025 European Delegation Law (Law No 36 of 17 March 2026). Approved at preliminary reading by the Council of Ministers on 2 October 2026 and sent to Parliament on 9 October 2026; in the Chamber of Deputies it is before the joint Constitutional Affairs and Transport Committees, whose opinion is due by 18 November 2026. It will then return to the Council of Ministers for final approval. Each authority will apply the regulation's penalties under its own procedures, consumers will be able to report vulnerabilities and incidents directly to CSIRT Italia, and infringements may be pursued through representative actions.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing act identified. CERT.LV has published guidance for manufacturers and handles reports.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Manufacturers' reports go to the coordinating CSIRT designated under NIS 2.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Manufacturers' reports go to the coordinating CSIRT designated under NIS 2.
Notifying authority: Malta Digital Innovation Authority (MDIA), with the assessment and monitoring of bodies entrusted to the National Accreditation Board. Market surveillance (from 11 December 2027): MDIA. Coordinating CSIRT (from 11 December 2027): the national CSIRT (CSIRTMalta, within MITA).
–
10 milestones, 5 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 September 2026 · National act published National (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
Notes · Regulations published in Government Gazette No 21,717 of 11 September 2026 and included in subsidiary legislation as S.L. 591.06. The designation of the notifying authority (regulation 8) applies from publication; the rules on skills, assessment of harmonised standards, CE marking, support for small enterprises, regulatory sandboxes, market surveillance, the coordinating CSIRT and administrative penalties (regulations 3 to 7 and 9 to 12) apply from 11 December 2027. Penalties under the MDIA Act (Cap. 591).
Uitvoeringswet verordening cyberweerbaarheid Cyber Resilience Regulation Implementation Act Kamerstukken 36 875 Official source (opens in a new tab)
Market surveillance and notifying authority: Dutch Authority for Digital Infrastructure (RDI).
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · Tabled on 18 December 2025 and passed by the House of Representatives on 10 September 2026; in the Senate, the Digitalisation and Economic Affairs committees submitted their written input on 27 October 2026 and the report is being prepared. Entry into force will be set by royal decree, possibly in stages.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Government guidance names CERT Polska (CSIRT NASK) as coordinator for vulnerability reports.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Manufacturers' reports go to the coordinating CSIRT designated under NIS 2.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · No implementing bill identified. Manufacturers' reports go to the coordinating CSIRT designated under NIS 2.
Zákon, ktorým sa mení a dopĺňa zákon č. 56/2018 Z. z. o posudzovaní zhody výrobku, sprístupňovaní určeného výrobku na trhu a o zmene a doplnení niektorých zákonov v znení neskorších predpisov a ktorým sa menia a dopĺňajú niektoré zákony Act amending Act No 56/2018 on product conformity assessment and other acts 318/2025 Z. z. Official source (opens in a new tab)
Market surveillance: National Security Authority (NBÚ), since 1 January 2026. The Office of Standards, Metrology and Testing (ÚNMS) can fine notified bodies.
1 January 2026
11 milestones, 6 already passed
10 December 2024 · Regulation enters into force EU (passed)
21 October 2025 · National act adopted National (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
1 January 2026 · National act enters into force National (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · Act No 318/2025, in force since 1 January 2026, designated the NBÚ as market surveillance authority for products with digital elements and allows the ÚNMS to fine notified bodies under Article 64 of the CRA. The comprehensive act on the cybersecurity of products with digital elements (UV-23199/2026), approved by the government, was sent to second reading by the National Council on 17 September 2026 and would apply from 1 January 2027.
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · According to the Government Information Security Office (URSIV), a government decree is in preparation; the text is not yet public. Secondary source.
Proyecto de Real Decreto por el que se designa a la autoridad notificante y a la autoridad de vigilancia del mercado para los productos con elementos digitales Draft Royal Decree designating the notifying authority and the market surveillance authority for products with digital elements Official source (opens in a new tab)
Under the draft: notifying authority, the National Cryptologic Centre (CCN); market surveillance, the Secretariat of State for Telecommunications and Digital Infrastructure (SETID), with INCIBE as supporting technical laboratory; single liaison office, the Directorate-General for Consumer Affairs.
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · The Ministry for Digital Transformation's draft royal decree was open for public hearing until 23 January 2026 and received the CNMC's opinion on 13 May 2026; it would enter into force the day after publication in the BOE. It does not cover penalties. As of late October 2026 it has not yet been adopted.
Kompletterande bestämmelser till EU:s cyberresiliensförordning (SOU 2025:115) Supplementary provisions to the EU Cyber Resilience Act (SOU 2025:115) Official source (opens in a new tab)
Market surveillance and notifying authority: designated by the government; the inquiry makes proposals in its report.
–
9 milestones, 4 already passed
10 December 2024 · Regulation enters into force EU (passed)
11 December 2025 · Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392) EU (passed)
11 June 2026 · Rules on conformity assessment bodies apply EU (passed)
11 September 2026 · Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform EU (passed)
11 December 2026 · Member States strive to ensure a sufficient number of notified bodies EU (upcoming)
11 December 2027 · The regulation applies in full EU (upcoming)
11 June 2028 · EU-type examination certificates issued on cybersecurity under other EU legislation expire EU (upcoming)
11 September 2028 · Commission report on the effectiveness of the single reporting platform EU (upcoming)
11 December 2030 · First evaluation and review report on the regulation (then every four years) EU (upcoming)
National implementing measures not yet complete
Notes · The inquiry report (December 2025) proposes a new act and a new ordinance, with penalties that can also apply to public authorities. The consultation closed on 22 April 2026; there is no government bill to the Riksdag yet.
Data checked against official sources on 29 October 2026. The text published in each Member State’s official journal always prevails.