Language
Language 
Release time：2026-10-11 Visits：11
On 11 September 2026, the European Union's Cyber Resilience Act (CRA) — Regulation (EU) 2024/2847 — stopped being a future deadline and became a live legal duty. From that date, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe security incidents to EU authorities, the European Commission states. The obligation reaches any keyboard manufacturer shipping to Europe. Full application follows on 11 December 2027, when a product without a completed conformity assessment, technical documentation and a CE marking [需人工核实] cannot be placed on the EU market.
The European Union Agency for Cybersecurity (ENISA) launched the CRA Single Reporting Platform (SRP) on the same day. It gives manufacturers one reporting channel instead of separate national notifications, and EU Computer Security Incident Response Teams (CSIRTs) use it to receive and share those reports, ENISA said on 11 September 2026.
| Date | Milestone | Source |
|---|---|---|
| 10 December 2024 | CRA enters into force | European Commission |
| 11 December 2025 | Delegated act on delaying dissemination of notifications | European Commission |
| 11 June 2026 | Rules on notifying conformity assessment bodies apply | European Commission |
| 27 July 2026 | Commission publishes practical guidance on the CRA | European Commission |
| 11 September 2026 | Article 14 reporting duties apply; ENISA launches the Single Reporting Platform | ENISA; BSI |
| 11 December 2027 | Full application: Annex I requirements, conformity assessment, CE marking [需人工核实] | European Commission |
Sources: European Commission CRA policy and Reporting obligations pages; ENISA, "The CRA Single Reporting Platform is launched", 11 September 2026; German Federal Office for Information Security (BSI) press release, 11 September 2026, which names CERT-Bund as the coordinating CSIRT for manufacturers based in Germany. September 2026 is already running; December 2027 decides whether a product can enter the EU at all.
The CRA covers "products with digital elements" — hardware or software, and their remote data processing solutions, whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to another device or network. The European Commission publishes that definition.
Read it against a keyboard. A wired keyboard sends scan codes to a host over USB. A wireless mouse holds a 2.4 GHz or Bluetooth link to a receiver or host. Both are physical data connections, so both sit inside the published scope. Confirm the classification of a specific SKU with counsel or a notified body: the regulation carves out medical devices, vehicles, aviation and marine equipment, identical spare parts and national security products.
One clause changes the risk for brands. Under Article 21, an importer or distributor that places a product on the EU market under its own name or trademark, or that substantially modifies it, is treated as the manufacturer. Buy an OEM keyboard, put your logo on it, and you are the manufacturer — not the factory that moulded the housing. Legal 500's client alert sets out that position; verify it against the Official Journal text.
| Step | Deadline |
|---|---|
| Early warning | Within 24 hours of becoming aware |
| Full notification | Within 72 hours of becoming aware |
| Final report — actively exploited vulnerability | No later than 14 days after a corrective measure is available |
| Final report — severe incident | Within one month |
Manufacturers report once, through the SRP, to the CSIRT of their main establishment, which shares the notification with the CSIRTs of every Member State where the product is available. Prior registration is not required, and BSI notes that a submission can be completed in minutes. The duty also applies to products already on the EU market, not only to new placements. The constraint is not the portal; it is whether your organisation knows who files, and how fast.
| Breach | Maximum administrative fine |
|---|---|
| Annex I essential requirements; Articles 13 and 14 obligations | EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher |
| Other operator obligations (importers, distributors, conformity assessment, CE marking) | EUR 10 million or 2% |
| Supplying incorrect, incomplete or misleading information | EUR 5 million or 1% |
Those ceilings come from Article 64 of Regulation (EU) 2024/2847 and are set by Member States. The bigger commercial risk is not the fine: authorities can order a product restricted, withdrawn or recalled — and without a valid CE marking [需人工核实] it cannot lawfully enter the EU market.
Wireless products now carry two overlapping regimes. Since 1 August 2025, radio equipment placed on the EU market must meet the cybersecurity requirements in Article 3.3(d), (e) and (f) of the Radio Equipment Directive, introduced by Delegated Regulation (EU) 2022/30 and assessed against the EN 18031 series [需人工核实]. A Bluetooth or 2.4 GHz keyboard or mouse is radio equipment, and the CRA sits on top of it. Compliance with one does not discharge the other.
Firmware becomes a purchasing decision. Secure boot, signed updates, a documented update path and a support period are now legal conditions rather than engineering preferences. Buyers will ask which MCU a keyboard uses, which Bluetooth stack, and whether over-the-air updates are signed.
Documentation requests move down the supply chain. Brands carrying manufacturer-level liability will ask factories for component data, a component list in SBOM form and a support-period statement. Factories that answer in writing will hold their EU accounts: a brand cannot file a 24-hour early warning on a vulnerability it cannot see.
SKU rationalisation accelerates. Conformity assessment, documentation and a support-period commitment attach to each product, so spreading modest volume across twelve near-identical keyboard variants multiplies the work. Expect buyers to consolidate.
| Area | What changes |
|---|---|
| Certification | CE marking and an EU Declaration of Conformity become mandatory from 11 December 2027. Most keyboards and mice sit in the default risk class, where self-assessment against harmonised standards applies [需人工核实]. |
| Cost | Budget firmware security work, an SBOM process, vulnerability handling and documentation — a small line next to tooling, but a recurring one. |
| Lead time | Add a compliance questionnaire to DFM and quotation. Our DFM feedback and quotations both run 1–3 working days; a compliance pass adds review, not weeks. |
| MOQ | Fewer SKUs and larger runs cut the per-product compliance load. Consolidating three variants into one model is usually the cheapest route. |
| Mould and tooling | Security lives in firmware, not in the steel. Tooling is largely unaffected, though housing geometry still has to fit antenna keep-out and the USB-C port position. |
| Wireless performance | Antenna placement, pairing security and stack version now carry compliance weight. Specify them at design freeze, not after T1. |
| Battery | Battery transport and product-safety rules sit in separate regimes from the CRA [需人工核实]. Confirm your cell and pack classification before committing to a shipping plan. |
| Packaging | The support period end date must be stated at purchase, and security and update information must reach the user. That changes the insert card, not the carton. |
| Logistics | Customs and market surveillance can stop a non-compliant shipment. For non-EU makers, jurisdiction follows Article 14(7) via the authorised representative or importer. |
A keyboard and mouse factory with in-house moulding has an advantage here: component data, material traceability and dimensional control sit in one building rather than across three suppliers. Our line runs from design and prototyping through mass production, QC and delivery in a single 12,000 m² plant, with 50 injection machines from 140T to 500T and a 30-machine mould shop. ISO 9001 quality management is in place [需人工核实].
On the Commission's published scope definition, yes. The test is whether the product's intended or reasonably foreseeable use includes a data connection to another device or network. A wired keyboard sends data to a host over USB.
Probably. Under Article 21, an importer or distributor placing a product on the market under its own name or trademark is treated as the manufacturer and carries the obligations in full, including the 24-hour and 72-hour reporting duties.
Yes. They apply to products already available on the EU market, not only to units placed there after 11 September 2026. The wider Annex I requirements apply from 11 December 2027.
Component-level data or a component list, material and traceability information, a support-period statement, evidence that firmware updates can be delivered and signed, and dimensional and functional test records.
Both. September 2026 is the reporting duty and it applies to existing stock. December 2027 is the market-access deadline: from that date, an in-scope product without a completed conformity assessment and a CE marking cannot lawfully enter the EU market.
The Cyber Resilience Act has moved from drafting to enforcement. Reporting duties have applied since 11 September 2026, ENISA's Single Reporting Platform is live, and full application follows on 11 December 2027 with CE marking as the gate to the EU market. For a keyboard manufacturer or a mouse buyer, the consequence is simple: compliance data becomes part of the product specification, and the factory that can supply it becomes part of the compliance chain.
If you are specifying a new keyboard or mouse programme for the EU, settle the firmware and support-period questions before you freeze the industrial design. Send your 3D and 2D files and we will return DFM feedback in 1–3 working days.
Request a quote, get a free sample, or upload your design for a free DFM review. For OEM and ODM keyboard and mouse programmes, discuss your project with our team and we will map the tooling, the moulding and the documentation to your EU timeline.
