After publication in the Official Journal of the European Union on November 20, the regulation will enter into force on the 20th day after publication. The provisions will be applicable from 36 months after that date. However, Article 14, on notification requirements for critical vulnerabilities, will be applicable after 21 months.
Economic operators must ensure that products meet essential security requirements, including the absence of known vulnerabilities and the ability to receive security updates.
The CRA also establishes a penalty apparatus to ensure compliance, with measures that can include significant fines for manufacturers who fail to comply with safety requirements.
