REG-011
Cyber Resilience Act applies in full
11 December 2027
in 462 days
Products with digital elements cannot be sold in the EU without secure-by-design evidence, a vulnerability handling process, a software bill of materials and CE marking for cybersecurity.
The sentence that fixes the date
This Regulation shall apply from 11 December 2027.
Regulation (EU) 2024/2847, Article 71 — Regulation (EU) 2024/2847, OJ text
The day it lands
11 December 2027
462
days remaining
Counted from the date in the official journal text linked on this page. Arithmetic, not a forecast.
Who is forced to spend
Who
Manufacturers, importers and distributors of anything with digital elements sold into the EU, down to a single-developer firmware vendor.
What they spend today
Penetration tests, ISO 27001 audits and security consultancy, bought per release and priced per day.
Sector
Software and connected hardware
No dossier yet for this catalyst.
Dossier 001 is open end to end, free, so you can see exactly how deep a dossier goes before this one exists.