图片名称

LCS Network Security | Key Focus: Can the CRA be exempted if the product is produced before November 11, 2027.12? 90% of companies have stepped on these 'pitfalls'

Author.

LCS

Source:

Post time:

2026-08-11

 

In the past two weeks, the question we have been asked the most is actually the same - "Can we waive CRA if our product is produced before July 11, 2027? The answer is: not necessarily. This may be the most expensive cognitive misconception of the year.


 

First, understand the key node of July 11, 2027
 

What is 2027.12.11?

December 11, 2027, is the official date for the full implementation of the European Union's Cyber Resilience Act (CRA). Products containing digital elements launched into the EU market after this date must meet all CRA compliance requirements. Products that have been launched on the market before this date are exempt from CRA requirements (except for vulnerability and incident reporting obligations).



 

What is' market placement '?

According to Article 3 of the CRA regulations, "placing on the market" refers to the first time a product containing digital elements is made available on the EU market (with emphasis on three times). For imported products, the key time point is the time when customs release the goods for free circulation, rather than the date of entry or production.


 

Consequences of non-compliance:

❌   Non compliant products after November 11, 2027.12 are prohibited from affixing CE markings and from being placed on the EU market

❌   High penalty: 2.5% of global annual revenue or 15 million euros, whichever is higher, a fine will be imposed


 

Emphasis should be placed on:


 

The core of CRA compliance judgment is the time of "market launch", not the production date or entry date. Entering customs ≠ entering the market, the key is the customs clearance time. Enterprises must plan the shipping cycle and compliance certification time in advance to ensure completion of deployment before November 11, 2027.12, or to complete CRA compliance rectification ahead of schedule.


 

It sounds very clear, doesn't it? But pitfalls and misunderstandings are all in the details, which will be explained clearly below.


 1、 90% of companies fall into two common misconceptions about CRA, don't fall for them

 

Misconception 1: If a product is produced before November 11, 2027.12, it will automatically be exempt from CRA.


 

Key misconceptions need to be corrected: CRA's judgment is based on the time of "market launch" rather than the production date. Even if the product has been produced before December 11, 2027, if it is only released into the EU market after December 11 (inclusive) (i.e. customs clearance for free circulation), the product must still meet all CRA compliance requirements. Production is no longer useful, the key is the time to launch it into the market.


 

Misconception 2: The product has already been shipped to EU ports for customs clearance, so it should be considered as "put on the market".


 

Key misconceptions need to be corrected: "Entry" and "Market Launch" are two completely different concepts. Entry is a physical action that refers to the entry of goods into the customs territory of the European Union; Placing on the market is a legal action, referring to the free circulation and release by customs. If the product has entered customs before December 11th but is stored in a customs supervised warehouse or bonded area, and is not released for free circulation until after December 11th, and is still placed on the market after December 11th, it still needs to comply with CRA. Entering customs early is useless, the key is the release time.


 

2、 As of November 11, 2027.12, analysis and solutions for the four major pain points of enterprise landing

 

 

Pain point 1: Entry ≠ market launch, time judgment can easily lead to pitfalls


 

Many companies mistakenly believe that transporting goods to EU ports and completing customs clearance is equivalent to "putting them on the market", but in reality, the key time point is the free circulation and release of goods at Shanghai Customs. If the product stays in the customs supervision warehouse until after December 11th before being released, even if the entry time is before December 11th, the batch of products still needs to meet CRA requirements.


 

👉  Breaking the deadlock: Enterprises must regard the "customs clearance time" as the core control node, rather than the entry time or production date. It is recommended to reserve sufficient shipping time and clearance time to ensure that the goods are released for free circulation by customs before December 11th. Lixun can provide complete CRA compliance time planning consulting services to help enterprises accurately control the delivery nodes


 

Pain Point 2: Compliance Game of Batch Delivery, Partial Exemption and Partial Compliance


 

When products of the same model are released in batches on the EU market, batches released before 12.11 are exempt from CRA (except for vulnerability and incident reporting obligations), while batches released after 12.11 must meet CRA requirements. Enterprises need to clearly distinguish the release time of each batch in the shipment plan to avoid confusion.


 

Two implementation plans help enterprises break through:

✅  Option 1 (window grabbing plan, suitable for companies shipping before December 11th): All products should be launched into the EU market before December 11th, and sea freight arrangements should be initiated before October 10th to ensure completion of EMC and other basic tests, obtaining corresponding qualifications, and CE labeling before December 11th.


 

✅  Option 2 (CRA compliance plan, suitable for companies that continue to ship after December 11th): After completing CRA certification and obtaining NB notified body certificate (if self declared, also subject to CRA compliance assessment), CE marking can be affixed to arrange shipment. The sea freight and CRA NB certification process can also be initiated synchronously, with the prerequisite that the product does not undergo hardware/software changes during the certification application stage, or that the product supports OTA remote program upgrades. Lixun can provide one-stop CRA compliance landing services, increasing efficiency by 50%


 

Pain point 3: Dual time pressure of shipping cycle and compliance certification


 

Enterprises that choose to seize the window period plan are facing pre pressure from the estimated shipping cycle (2 months) and basic testing; Enterprises that choose compliance solutions face the dual challenges of CRA certification cycles (usually 5-7 months) and tight schedules for NB announcement agencies. Both paths require planning to be initiated at least six months in advance. The key points of the time cycle that I have sorted out for you are as follows:

Compliance certification (5-7 months): system construction+technical compliance+rectification+certification

Shipping+List (2 months): Shipping ->Entry ->Release


 

👉  Breaking through: Lixun provides one-stop compliance landing services, with experts following up throughout the process, sorting out the company's product line, and customizing an exclusive compliance promotion schedule. Anticipate the order quantity in advance based on customer demand, or complete the delivery of all goods before December 11th; Either complete the CRA rectification and arrange for the remaining goods to be released, without having to explore and step on their own.


 

Pain point 4: Compliance is still required for subsequent production of the same model, which can easily result in budget omissions


 

According to Section 2.2 of the EU Blue Book, EU harmonization legislation applies to individual products rather than product types. Even if the first sample of a certain model was launched on the market before December 11th, the same product produced after December 11th still needs to meet CRA requirements. Many companies have only planned exemption strategies for existing products, but have overlooked CRA compliance budgets for subsequent production batches.


 

👉  Breaking the deadlock: Enterprises need to simultaneously inventory the models that must be released before 12.11 and the models that need to continue production after 12.11. For the latter, it is necessary to initiate CRA compliance gap analysis, streamline certification schedules, and calculate compliance costs in advance. Lixun provides standardized document templates and one-stop compliance services, which are ready to use out of the box and meet the official audit requirements of the European Union.


 

Our advantage!!!


 

The Network Security Laboratory of Lixun Network Security Department holds dual authoritative laboratory qualifications of CNAS and A2LA, and has been deeply involved in EN18031, ETSI EN 303 645, IEC62443, ISO27001 and SDLC landing projects. It has rich experience in network security technology and information security system construction, and is equipped with a team of senior compliance and security experts, relying on mature project accumulation to comprehensively support the implementation of enterprise CRA compliance.


 

For more details on the plan, please contact Lixun in a timely manner.

Media Center

Latest News

Contact Us

图片名称
图片名称

National 24-hour service hotline

400-116-2629

Group Headquarters

Cell phone:18126505465

E-mail: webmaster@lcs-cert.com

Address: Shenzhen City, Baoan District, Shajing Street, Nga side of the school of Wei Juji Industrial Park, Building A 1 ~ 2 floor, Building C 3 floor