The Cyber Resilience Act has more than one important date. As of October 15, 2026, manufacturer reporting obligations are already in effect. Treating December 2027 as the first action date would miss that earlier milestone.
Use the European Commission's CRA overview to establish the product scope and your organization's role. It concerns products with digital elements made available on the EU market, with defined conditions and exclusions. It is not a rule that every organization using Microsoft 365 must buy an identity product.
Put the two dates on separate work plans
| Date | Planning consequence |
|---|---|
| September 11, 2026 | Manufacturer reporting obligations for actively exploited vulnerabilities and severe security incidents began |
| December 11, 2027 | Full application of the CRA |
The Commission's implementation timeline is the source for these dates. Its reporting guidance describes an early warning within 24 hours of awareness and a full notification within 72 hours. Final-report deadlines depend on the event type; use the official guidance when building the response procedure.
Assign product-security work to product owners
A practical readiness review should identify the product, responsible organization, security owner, supported versions, vulnerability intake route, and update process. Have appropriate legal and product specialists determine applicability for the specific offering.
For an internal planning exercise, select one product and trace a hypothetical vulnerability from discovery to customer communication and a deployed correction. Record the handoffs and evidence the team would need. This is a proposed exercise, not a legal conformity assessment.
Distinguish workforce accounts from product credentials
Workforce identity controls determine which people can reach engineering systems, release tools, and administrative consoles. Product identity and cryptographic controls concern credentials and trust used by devices, software, and update mechanisms.
A workforce lifecycle tool may help govern engineers' accounts. It does not automatically manage product certificates, signing keys, vulnerability disclosures, or conformity evidence. Give those responsibilities explicit owners rather than claiming one identity platform covers the whole act.
Keyfactor's article provides a vendor perspective on cryptographic preparation and PKI. It is useful background for that part of the project; official sources above control this article's scope and date statements.
Make the next review concrete
Ask the product team to demonstrate who can authorize a release, how access changes when an engineer leaves, who controls signing credentials, and how an urgent report reaches the responsible team. Record unresolved responsibilities before selecting software.
For the workforce portion, use the NIM lifecycle guide and urgent termination checklist. They address account operations and verification, not a promise of CRA compliance.