The CRA does not have one implementation date. Chapter IV applies from 11 June 2026, Article 14 reporting from 11 September 2026, and most remaining provisions from 11 December 2027. A single programme labelled “CRA by 2027” can therefore miss an earlier operational duty.
Build three workstreams with clear interfaces instead of one undifferentiated checklist.
11 June 2026: conformity infrastructure
Chapter IV concerns notification of conformity-assessment bodies. For a manufacturer, the immediate planning question is not to claim that a particular notified body or assessment route is already available. It is to monitor the official designation landscape and keep product classification and assessment assumptions current.
Assign regulatory engineering to track competent authority and notified-body information from official sources. Record the date checked, product category assumption, intended conformity route, unresolved dependencies, and owner. Do not use a marketing statement from a service provider as evidence of formal notification status.
11 September 2026: live reporting operations
Article 14 requires an operational decision and notification capability. Give product security ownership of signal intake, awareness decisions, two reporting tracks, deadlines, coordinating-CSIRT routing, assigned representatives, report content, user communication, and filing evidence.
Test the process outside business hours. Use a product-specific scenario and measure time to identify the manufacturer, affected product, reporting track, decision owner, and early-warning handoff. Stop the exercise before any real external submission.
This workstream needs to function even when the broader 2027 technical file is incomplete. It can use controlled product inventories and evidence created for the longer programme, but it cannot wait for that programme to finish.
11 December 2027: product conformity and lifecycle duties
Maintain the separate programme for cybersecurity risk assessment, essential requirements, vulnerability handling, technical documentation, conformity assessment, declaration, marking, user information, support-period controls, and economic-operator obligations as applicable.
Map every product and release plan to the date on which units will be placed on the Union market. Track substantial modifications to earlier products with legal and engineering review. Keep the detailed applicability decision product-specific.
Connect the workstreams deliberately
Use one canonical product register across all three. Give every product a legal manufacturer, classification hypothesis, release/version identifiers, EU-market status, support information, security contact, reporting route, and evidence owner.
Changes in classification or product boundary should trigger review of both conformity plans and incident runbooks. A reporting exercise that cannot identify a shipped version exposes an inventory gap relevant to 2027; a conformity review that changes the manufacturer entity exposes a reporting-routing gap relevant now.
Report progress by date-specific capability, not an overall percentage. Leadership should see whether the 11 June 2026 monitoring control, 11 September 2026 reporting operation, and 11 December 2027 conformity work are each ready, at risk, or blocked—and why.
Continue this workflow with the legacy-product triage and the readiness exercise.