The CRA dates, and the standards timeline

Most CRA timelines you will find are a list of eight or ten dates with no indication of which ones create obligations. Three do. The rest are either administrative milestones that have already passed or projections about other people's work — useful for planning, and not deadlines you can miss.

The dates that bind

That is the whole of it. If a timeline shows you more dates than this with the word "deadline" attached, check what each one is a deadline for — most are deadlines on the Commission or the standardisation bodies, not on you.

The standards schedule, and what the dates mean

Standardisation request M/606 was accepted by CEN, CENELEC and ETSI in April 2025. It asks for two kinds of standard:

• Horizontal standards, which apply across products — the ones on secure development and vulnerability handling do the heavy lifting for most manufacturers.
• Vertical, product-specific standards for particular categories.

The delivery dates, as they stood when this page was written:

Nothing in that table is a deadline on you. They are deadlines on the standardisation bodies, and the last one lands six weeks before the Regulation applies in full.

Delivery is not citation, and the gap matters

This is the part that changes how you should plan, and it is almost always left out.

A harmonised standard does not do anything for you by existing. Article 27 confers a presumption of conformity only once the standard's reference has been published in the Official Journal of the European Union. Two separate events:

1. Delivery. The standardisation bodies finish the standard and hand it to the Commission by the date in the request. The dates in the table above are these.
2. Citation. The Commission assesses it and publishes its reference in the Official Journal. Only now can you cite it and rely on the presumption.

The gap between the two is an assessment process, and across EU harmonisation legislation generally it has historically run to months rather than weeks — sometimes considerably longer where the Commission asks for revisions.

It has already slipped once

In mid-2026 a draft amendment to the standardisation request moved two of the tranches back by two months:

Two months is not dramatic in itself. What it tells you is that this schedule moves, and that any compliance plan whose critical path runs through a standard being citable by a particular date is resting on someone else's slipping deadline.

It is also a reason not to wait. A manufacturer who decided in 2025 to start once the standards landed has now been waiting a year, and the December 2027 date has not moved.

What to do while there is nothing to cite

The Regulation anticipated this, and the answer is in the annexes rather than in a workaround.

Annex VII point 5 asks for a list of the harmonised standards applied in full or in part, common specifications or cybersecurity certifications — and, where none were applied, a description of the solutions adopted to meet the essential requirements. So an empty standards list is a contemplated state, not a gap, provided the description is there.

Which means, concretely:

• Your declaration of conformity's standards section says that none is cited, plainly, and does not invent one. What point 6 asks for.
• Your risk assessment carries the argument instead, requirement by requirement across Annex I Part I. This is why it matters more under the CRA today than the equivalent document does under a mature regime. The thirteen requirements.
• Technical references you did follow get cited as what they are. If you work to IEC 62443-4-1, say so as part of the description of the solutions adopted — not as a harmonised standard, because it is not one and is not expected to be cited as one.
• Never cite a draft as though it were cited. A reference to a prEN in a signed declaration is a misleading statement in the first document an authority reads.

The Class I problem

For most manufacturers the missing standards make the paperwork slightly more effortful. For Annex III Class I products they do something worse.

Article 32(2) requires a notified-body route where the manufacturer has not applied, or has applied only in part, the relevant harmonised standards, common specifications or an equivalent certification scheme at substantial assurance level — and also where such standards, specifications or schemes do not exist.

On the plain reading, that is where Class I manufacturers are today: there is no standard to apply in full, so the condition for self-assessment cannot be met. Plan for EU-type examination or full quality assurance, and treat a notified body's lead time as a release dependency rather than assuming the standards will arrive in time to rescue the self-assessment route. The routes, and which list you are on.

What to watch, and how often

Four things, and monthly is enough for all of them:

1. The Official Journal, for citations of harmonised standards under the CRA. This is the one that changes your Annex VII point 5 answer and, for Class I, your conformity route.
2. The implementing act specifying the SBOM format and elements under Article 13. Not adopted at the time of writing. When it lands, every SBOM you hold may need re-examining. Why.
3. Further classification acts. An implementing regulation already gives technical descriptions of the Annex III and Annex IV categories, and the Commission can amend Annex III by delegated act. Your classification is not a permanent answer.
4. Corrigenda to the Regulation itself. It has already been corrected twice, once substantively — a change to Article 64(10) that widened a penalty derogation. The text moves.