The CRA does not have one start date. Chapter IV applies from 11 June 2026. Article 14 reporting starts on 11 September 2026. Most other rules apply from 11 December 2027.
A programme called “CRA by 2027” can miss an earlier duty. Build three linked workstreams instead of one long checklist.
11 June 2026: conformity infrastructure
Chapter IV covers the notification of conformity assessment bodies. A manufacturer should not assume that a given body or route is available. It should watch the official designation record instead.
Keep product classes and assessment assumptions current. Give this task to regulatory engineering. The team should use official authority and notified-body sources.
Record when each source was checked. Note the assumed product class and planned conformity route. List open dependencies and their owners.
A provider’s marketing claim is not proof of formal notification.
11 September 2026: live reporting operations
Article 14 needs a working decision and reporting process. Product security should own signal intake and awareness decisions. It should manage both reporting tracks and their deadlines. It also needs the coordinating CSIRT route and named filing representatives.
The process must cover report content, user notices, and proof of filing.
Test the process outside normal hours. Use a case tied to one product. Measure how long it takes to find the manufacturer and affected product. Then find the reporting track, decision owner, and early-warning handoff. Stop before any real filing.
This process must work before the wider 2027 technical file is complete. It may use controlled product records from that longer programme. It cannot wait for the programme to finish.
11 December 2027: product conformity and lifecycle duties
Keep a separate programme for product and lifecycle duties. It should cover cyber risk reviews and the essential requirements. It should also cover flaw handling, technical files, and conformity assessment.
Add declarations, markings, user information, and support-period controls. Include duties for each economic operator when they apply.
Map each product and release to its planned Union-market date. Track major changes to older products. Legal and engineering teams should review those changes together.
Decide detailed scope for each product. Do not rely on one group-wide answer.
Connect the workstreams deliberately
Use one controlled product register for all three workstreams. Give every product a legal manufacturer. Add the working product class and release identifiers. Record Union-market status and support details. Name the security contact, reporting route, and evidence owner.
A change in product class or boundary should start two reviews. Check both the conformity plan and the incident runbook.
A reporting drill may fail to find a shipped version. That exposes a product-record gap for 2027. A conformity review may change the manufacturer entity. That exposes a reporting route that needs attention now.
Report progress against each date. Do not hide it in one overall percentage.
Leaders should see the state of the 11 June monitoring control. They should see whether the 11 September reporting process works. They should also see the state of the 11 December 2027 conformity work. Mark each area ready, at risk, or blocked, and explain why.
Continue this workflow with the legacy-product triage and the readiness exercise.