How do I prepare for the 11 December 2027 CRA deadline?

The Regulation applies from 11 December 2027. Article 71(2) then carves out exactly two derogations that move earlier: Article 14 applies from 11 September 2026, and Chapter IV, Articles 35 to 51, applies from 11 June 2026.^[1] Nothing else moves.

Those two exceptions are not arbitrary. Chapter IV governs notification of conformity assessment bodies, so it lands 18 months early to ensure notified bodies exist and are designated before manufacturers need to book them. Article 14 lands 15 months early because vulnerability reporting does not depend on the conformity machinery being finished.

Planning against 11 December 2027 alone is therefore a mistake with a specific cost. It puts the reporting obligation, which binds first, at the end of the programme.

Classification decides the conformity assessment route, and the route decides whether a third party is in the project. A default product self-assesses under module A. An Annex III class I product keeps module A only where harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial cover the applicable requirements. Class II loses module A in every case, and an Annex IV critical product takes a certification scheme under Article 8(1) or, where its conditions are not met, the class II routes.^[3]

Every other stage of preparation can run in parallel once the class is settled, and none of them can be scheduled sensibly before it. Notified body capacity is finite and designations were still expanding after Chapter IV applied in June 2026, so a class II or critical manufacturer that classifies late finds the queue rather than the calendar setting its deadline.^[1]

The classification and its reasoning belong in the technical documentation, not in someone's notes.^[4]

From that date, becoming aware of an actively exploited vulnerability in your product, or of a severe incident affecting its security, starts a 24-hour clock to an early warning, a 72-hour clock to a full notification, and a final report after that.^[2]

What this requires operationally is narrower than a compliance programme. You need a channel through which a researcher, customer or authority can reach you, a triage step that produces a documented awareness determination, somewhere the three deadlines are tracked, and a settled answer to which CSIRT is your coordinator.

The ordering trap is worth naming. The coordinated vulnerability disclosure policy and single point of contact that make you aware of these events are Article 13 obligations, and Article 13 does not bind until 11 December 2027.^[1] The duty that depends on running disclosure lands more than a year before the duty to run disclosure, so the intake channel is a September 2026 deliverable whatever the formal date on Article 13 says.

Everything not carved out by Article 71(2) arrives together.^[1] The Annex I essential requirements, the Article 13 manufacturer obligations including the risk assessment and the support period, the Article 31 technical documentation, the Article 32 conformity assessment, the Article 28 EU declaration of conformity, and the Article 30 CE marking rules.

Sequence that block by dependency rather than by effort. The risk assessment determines which Annex I requirements apply, so it precedes the gap work. The Annex I positions and their evidence are what the technical file reports, so the file is an output rather than a separate writing exercise. The declaration of conformity is a signed legal statement that rests on the file, and the CE marking follows the declaration.

Teams that treat the technical documentation as an end-stage document sprint reconstruct decisions from memory and produce a file that contradicts the product. Recording the classification reasoning, the risk assessment and the evidence as the work happens turns the file into a report of what was done.