Key takeaways
- The Cyber Resilience Act’s early reporting duty starts 11 September 2026, and its full set of requirements applies from 11 December 2027.
- The EU Battery Regulation requires portable batteries in most consumer devices to be removable and replaceable by the end user starting 18 February 2027.
- CE marking under the Cyber Resilience Act plugs into the EU’s existing CE marking system rather than creating a separate mark.
- A separate EU rule on radio equipment cybersecurity has applied since 1 August 2025 and is scheduled for repeal on 11 December 2027, the same day the Cyber Resilience Act takes full effect.
The Cyber Resilience Act’s main compliance date is 11 December 2027, when its full cybersecurity requirements apply to connected hardware placed on the EU market. An earlier deadline, 11 September 2026, already requires manufacturers to report actively exploited vulnerabilities and severe incidents. The EU Battery Regulation adds a separate deadline, 18 February 2027, when portable batteries in most consumer devices must be removable and replaceable by the end user without specialized tools. Each date governs a different obligation, and a hardware team selling into the EU needs all three dates on the same calendar, not three separate ones.
What the Cyber Resilience Act Covers
The Cyber Resilience Act, Regulation (EU) 2024/2847, applies to “products with digital elements”: hardware or software whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. A Bluetooth sensor, a Wi-Fi appliance or a cellular tracker all qualify; a purely analog product with no digital interface does not.
The regulation carves out categories already governed by other EU safety regimes, generally including:
- Medical devices and in-vitro diagnostics, already regulated under the EU’s medical device rules.
- Certain motor vehicle systems, aviation equipment and marine equipment, each covered by its own EU safety regime.
- Products not supplied in the course of a commercial activity.
Confirm the exact boundary for a specific product against the regulation’s own text on EUR-Lex.
Free tool: check if your invention is ready to build, in 3 minutes →The Full CRA Timeline: 2024 to 2027
The Cyber Resilience Act phases in four separate obligations over three years:
| Date | What applies |
|---|---|
| 10 December 2024 | The regulation enters into force (20 days after Official Journal publication). |
| 11 June 2026 | Chapter IV applies: EU member states must have conformity assessment (notified) bodies in place. |
| 11 September 2026 | Article 14 applies: manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA. |
| 11 December 2027 | Full application: essential cybersecurity requirements, manufacturer obligations, conformity assessment and CE marking apply to in-scope products. |
A product already on the EU market before 11 December 2027 is not retroactively pulled into the full regulation, provided it is not substantially modified afterward. The Article 14 vulnerability-reporting duty, however, already applies to those legacy products from 11 September 2026.
The EU Battery Regulation’s Removable Battery Rule
A separate law, the EU Battery Regulation (Regulation (EU) 2023/1542), sets its own deadline: Article 11 requires portable batteries to be “readily removable and replaceable” by the end user from 18 February 2027. In practice, that means removal using only commercially available tools, without soldering, specialized tools, or solvents, unless the needed tool ships free with the product.
The rule is not unconditional. The regulation, and a Commission guidance notice published in January 2025, set out specific exemptions:
- Appliances built to be regularly splashed or immersed and designed to be washed or rinsed, where end-user removability would compromise a safety seal.
- Professional medical imaging, radiotherapy and in-vitro diagnostic devices, where removal may be restricted to an independent professional rather than the end user.
- Products where continuous power is a safety requirement (the Commission’s own examples include implants, hearing aids and smoke alarms), or where it is needed for data integrity (examples given include weather stations and payment terminals).
Separately, light means of transport batteries, such as those in e-bikes and e-scooters, must still be removable and replaceable, but by an independent professional rather than the end user.
Re-check on 12 November 2026: the Commission has been expanding this exemption list through 2026, reportedly adding wearables and certain electric toys. Verify the exact regulation number and Official Journal date on EUR-Lex before relying on an exemption for a specific product.
How CE Marking Fits Both Rules
Neither law invents a new mark. The Cyber Resilience Act’s own text ties its CE marking requirement directly to Regulation (EC) No 765/2008, the general EU regulation that already governs CE marking across most product categories. A manufacturer completes the Act’s conformity assessment, draws up a declaration of conformity, and affixes the same CE mark already used throughout EU product law, now also certifying compliance with the Act’s cybersecurity essentials. The Battery Regulation requires its own CE marking before a battery is placed on the market, under the same general framework, and where a connected product also contains a battery, a single combined declaration can cover both regulations.
Where Radio Equipment Cybersecurity Rules Fit
A third rule already applies to most connected hardware. Delegated Regulation (EU) 2022/30, under the Radio Equipment Directive, has required Wi-Fi, Bluetooth and cellular devices to meet three cybersecurity essentials since 1 August 2025: network protection, personal data and privacy protection, and (where the device can transfer money or value) fraud protection.
The EU has already decided what happens when the Cyber Resilience Act takes full effect: Commission Delegated Regulation (EU) 2026/339, published in the Official Journal in April 2026, repeals the radio equipment delegated act, timed to take effect on 11 December 2027, the Cyber Resilience Act’s own main application date. The stated reason is to avoid the same equipment facing two overlapping cybersecurity regimes at once. Between 1 August 2025 and 11 December 2027, both rules are technically live together, worth planning around rather than treating as a contradiction.
A Dated Compliance Calendar for Connected Hardware
| Date | Rule |
|---|---|
| 1 August 2025 | Radio Equipment Directive cybersecurity essentials (Delegated Regulation 2022/30) become mandatory. |
| 18 August 2025 | Battery Regulation separate-collection symbol requirement applies. |
| 11 June 2026 | Cyber Resilience Act notified-body chapter applies. |
| 18 August 2026 | Battery Regulation general and capacity labelling requirements apply. |
| 11 September 2026 | Cyber Resilience Act vulnerability and incident reporting duty applies. |
| 18 February 2027 | Battery Regulation removable and replaceable battery rule, and QR code labelling, apply. |
| 11 December 2027 | Cyber Resilience Act full application; radio equipment cybersecurity delegated act repealed the same day. |
A product team building a connected device for the EU market in 2027 is realistically clearing three deadlines inside the same twelve months, not one.
What’s Still Moving
Two parts of this calendar were not fully settled as checked on 12 November 2026: the Battery Regulation’s Article 11 exemption list, under active expansion by delegated act through 2026, and the exact boundaries of the Cyber Resilience Act’s sectoral exclusions. Confirm the current EUR-Lex text before a compliance decision depends on either.
The general US consumer labeling program, the FCC’s Cyber Trust Mark, remains voluntary with no comparable deadline for retail products. A narrower federal rule is mandatory, though: a 2025 executive order directs federal agencies to require Cyber Trust Mark labeling on connected devices sold to the US government starting 4 January 2027, worth tracking if federal procurement is a sales channel. US-side requirements for a connected device still include their own FCC certification steps, covered in our FCC certification cost article, and our broader AI device compliance checklist for the US.
Frequently asked questions
What products does the Cyber Resilience Act apply to?
It applies to hardware or software “products with digital elements”: anything whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Products already regulated under separate EU safety regimes, such as medical devices and aviation equipment, are generally excluded.
When does vulnerability reporting start under the Cyber Resilience Act?
Article 14’s reporting duty, covering actively exploited vulnerabilities and severe incidents, applies from 11 September 2026, more than a year before the regulation’s full requirements take effect on 11 December 2027.
Does the Cyber Resilience Act require a new, separate CE mark?
No. It uses the same CE marking system set out in Regulation (EC) No 765/2008 that already applies across most EU product law. Compliance with the Act’s cybersecurity essentials is one more thing the existing mark certifies.
Which products are exempt from the EU’s removable battery rule?
The Battery Regulation exempts categories such as washable appliances where removability would break a safety seal, certain professional medical devices, and products where continuous power is a stated safety or data-integrity requirement. The exemption list was still being expanded by delegated act through 2026, so confirm current coverage on EUR-Lex for a specific product.
Do companies outside the EU need to comply with these rules?
Any product placed on the EU market has to comply regardless of where the manufacturer is based. A US or other non-EU company selling a connected device into the EU faces the same dates as an EU manufacturer.
What happens to the Radio Equipment Directive’s cybersecurity rule after 2027?
Delegated Regulation (EU) 2022/30, which has required network, data and fraud protection for radio equipment since 1 August 2025, is repealed effective 11 December 2027, the same day the Cyber Resilience Act’s own cybersecurity requirements take full effect, so the two regimes do not keep running in parallel.
Where Inventornest Fits
The client is responsible for selecting intended markets and validating customer demand; target-market analysis and market testing aren’t part of our standard feasibility service at Inventornest. We do ask which countries or regions a client intends to sell in, because those destinations may affect technical requirements and certification planning, and a product aimed at the EU market needs its battery design, connectivity choices and documentation planned with rules like these in mind from the start. External laboratory certification remains a separate professional activity from our own engineering work.
If you’re scoping a connected product for the EU market, our product prototyping services page covers how we structure that early-stage work, and our portfolio has examples of connected hardware we’ve engineered. You can book a consultation to talk through a specific product’s compliance timeline. This article is general education, not legal advice; for a specific compliance determination, consult a qualified attorney or the relevant regulator.
