How long does CRA compliance take, and which steps cannot be compressed?

Direct answer: the timeline is set by the regulation, not by the company, and you cannot wait for harmonised standards to be officially published before starting. Reporting obligations have applied since 11 September 2026; the remaining main obligations apply from 11 December 2027. Counting back from today, most of what must be finished before December 2027 is already on the critical path.

Statutory dates

The cybersecurity basis of the CE marking changes track: cybersecurity requirements for radio equipment currently follow the Radio Equipment Directive delegated regulation (EU) 2022/30, applicable since 1 August 2025 and usually demonstrated with the EN 18031 series. The European Commission has adopted the repeal of that regulation, effective 11 December 2027, after which the cybersecurity of radio products follows the CRA alone. EN 18031 work already done for the RED is not wasted, but for products placed on the market after December 2027 the technical documentation and conformity assessment must be based on the CRA. This is a change of track, and it must be budgeted early.

Harmonised standards matter, but waiting for official publication before starting is too late: a product designed to a harmonised standard and assessed against it obtains a "presumption of conformity", and important products class I need it to use the self-assessment route. The problem is time: as of August 2026 no CRA harmonised standard has been published in the Official Journal, while the main obligations apply from 11 December 2027. Redesigning products, completing technical documentation and scheduling notified-body assessments all take time, especially for products that carry CE. The right approach is to design and prepare now against the published draft standards (the prEN 40000 series and others), then run a gap comparison and reinforce once the standards are officially published, rather than starting only after publication.

The two things to determine first when preparing against drafts

• Product class: default products can self-assess; important products class I can self-assess only if they apply a harmonised standard, a common specification or an EU cybersecurity certification scheme; otherwise a notified body is required; important products class II and critical products always need a third-party assessment. With harmonised standards still unpublished, class I products should put a notified body into the plan and budget now.
• Supply-chain role: manufacturers carry the heaviest obligations; importers and distributors must verify that upstream parties comply. Placing a product on the market under your own name or trademark makes you the manufacturer in the regulation's definition, even if the product is purchased from someone else. The mix of ODM, OEM and own-brand models common among Taiwanese companies means each product line's role can differ and must be determined one by one.

Five stages, each depending on the last

1. Classification and role determination: decides whether you self-assess or go to a third party; everything else follows from it.
2. Cybersecurity risk assessment: the regulation requires it to be considered at design, development, production, delivery and maintenance.
3. Closing the gaps in essential requirements and technical documentation: implement Annex I and write the risk assessment and the standards applied into the technical documentation.
4. Conformity assessment: self-assessment, or a slot in a notified body's schedule.
5. Support-period operation: vulnerability handling and reporting until the end of the support period.

What cannot be compressed: if step 1 is wrong, everything after it is redone; if step 4 requires a third party, the timeline depends on the notified body's schedule, which is outside the company's control. The reporting process must be able to operate right now; there is no grace period.

Products with AI functions must overlay the AI Act timeline: under the AI Digital Omnibus adopted by the Council of the EU on 29 June 2026, high-risk AI embedded in regulated products applies from 2 August 2028, and stand-alone high-risk AI systems from 2 December 2027. If a product is governed by both the CRA and the AI Act, step 1 must also determine the AI risk class, step 2 must include AI-specific threats such as data poisoning and adversarial attacks, and the technical documentation should cover both regulations at once.

Winners' view

The most common misjudgement is treating December 2027 as the only deadline. Reporting obligations have already started and apply to products already on the market; that part should be built first, in parallel with conformity assessment, not after it.