What changed under the Cyber Resilience Act, what it means for the machines you build and sell, and what to do this month. We publish only when something changes what you have to do. Every item links to the official text.
Edited by Edge SDN. A summary, not legal advice. Always check the official text for your case.
By month October 2026 · September 2026 · August 2026 · July 2026 · June 2026 · April 2026 · February 2026 · December 2025
Practical impact Adds or clarifies a duty
On 15 October 2026 the German Bundestag adopted the law that implements the Cyber Resilience Act in Germany (government bill 21/6134), with one change to its entry into force.
New machines from 11 Dec 2027 Importers and distributors
Practical impact Adds or clarifies a duty
On 2 October 2026 the Italian Council of Ministers approved, in preliminary examination, the legislative decree adapting national law to the Cyber Resilience Act.
New machines from 11 Dec 2027 Reporting duty (Art. 14) Importers and distributors
Practical impact Standard milestone, read and align
The CEN-CENELEC work programme shows EN 40000-1-2, Principles, product risk management and lifecycle activities, together with EN 40000-1-1, Vocabulary, at the approval stage with the formal vote closed on 1 October 2026 and ratification…
New machines from 11 Dec 2027
Practical impact Standard milestone, read and align · Deadline 15 November 2026
On 13 August 2026 ETSI announced that 17 final draft European Standards of the EN 304 6xx series, the vertical CRA standards for product categories such as routers and switches, firewalls, VPNs, operating systems, hypervisors and network…
New machines from 11 Dec 2027
Practical impact Adds or clarifies a duty
On 27 July 2026 the Commission published Communication C(2026) 5252 with its guidance on the application of the Cyber Resilience Act under Article 26, after a public consultation on a draft.
New machines from 11 Dec 2027 Installed base Spare parts and substantial modification Open-source stewards
Practical impact Adds or clarifies a duty
Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, amends the AI Act, Regulation (EU) 2018/1139 and the Machinery Regulation (EU) 2023/1230.
New machines from 11 Dec 2027
Practical impact Sets or moves a date · Deadline 31 December 2026
On 7 July 2026 the Commission notified a draft decision amending standardisation request M/606 (C(2025) 618), with feedback open until 3 August 2026.
New machines from 11 Dec 2027
Practical impact Sets or moves a date · Deadline 11 December 2026
Articles 35 to 51 of the Cyber Resilience Act, on notifying authorities and conformity assessment bodies, apply from 11 June 2026 under Article 71(2).
New machines from 11 Dec 2027
Practical impact Sets or moves a date · Deadline 11 December 2027
Commission Delegated Regulation (EU) 2026/339 of 16 February 2026 repeals Delegated Regulation (EU) 2022/30, the act that activated the cybersecurity requirements of the Radio Equipment Directive.
New machines from 11 Dec 2027
Practical impact Adds or clarifies a duty
Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 was published in the Official Journal on 1 December 2025.
New machines from 11 Dec 2027 Importers and distributors