---
schema: 1
kind: threat
title: EU Cyber Resilience Act reaches its first hard deadline — notifying-authority designation due 11 June
headline: EU Cyber Resilience Act reaches its first hard deadline — notifying-authority designation due 11 June
summary: "UPDATE (originally covered 2026-W23 weekly): 11 June 2026 is the CRA's first mandatory operational milestone: under Chapter IV, member states must have designated the national authority responsible for notifying conformity-assessment bodies (CABs) for higher-risk product classes (European Commission, 2026-06-10)."
discovered_at: "2026-06-10T05:00:18Z"
event_date: 2026-06-10
run_id: 2026-06-10-c84347b2
priority: notable
immediate_action: null
tags:
  - law-enforcement
  - eu-nexus
regions:
  - europe
sectors:
  - public-sector
  - technology
entities:
  - "campaign:eu-cyber-resilience-act"
  - "policy:eu-cyber-resilience-act"
cves: []
sources:
  - url: "https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation"
    publisher: "European Commission, 2026-06-10"
    role: primary
closed_sources: []
evidence: []
verification: single-source
sourcing_note: "migration: update target unresolved (no originally-covered date in v2 body)"
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions: []
migrated_from: briefs/2026-06-10.md
---

**UPDATE (originally covered 2026-W23 weekly):** 11 June 2026 is the CRA's first mandatory operational milestone: under Chapter IV, member states must have designated the national authority responsible for notifying conformity-assessment bodies (CABs) for higher-risk product classes ([European Commission, 2026-06-10](https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation)). This is the upstream gate for the September 2026 incident-reporting obligations (Article 14) and full CRA applicability in December 2027; manufacturers of Class II/III products can now begin engaging notified CABs.

No Commission communiqué naming specific member-state designations had been published as of this brief — the confirmed fact is the regulatory deadline itself. Public-sector procurement of connected devices is directly downstream of this milestone. [SINGLE-SOURCE]