CRA update, June 2026: Notified Bodies, ENISA rules, SRP onboarding

The EU Cyber Resilience Act’s operational machinery moved in three concrete ways between mid-May and mid-June 2026. If you are a manufacturer preparing for conformity assessment or the September reporting deadline, here is what changed and what to do about it this week.

1. Notified Body designation began on 11 June 2026

Chapter IV of the CRA entered into application a week ago. Member States have now had to designate their notifying authorities and publish the procedures for assessing, designating and notifying Conformity Assessment Bodies. The designation pipeline is officially open.

The reality check: as of mid-June, no CRA Notified Bodies have actually been designated yet, and no harmonised standards have been published in the Official Journal. Article 35(2) says Member States “shall strive to ensure” a sufficient number of Notified Bodies by 11 December 2026, six months from now. That is a best-efforts obligation with no enforcement mechanism attached, so read it as a statement of intent rather than a guaranteed date. Manufacturers planning the Class I (no-harmonised-standard route), Class II or Critical path should still treat Notified Body capacity as the practical constraint on the rest of 2026.

2. ENISA’s competence requirements for CRA Notified Bodies are out

ENISA has published the technical competence requirements that Notified Bodies must meet before they can be assessed, designated, notified and monitored by Member States. This is the operational document that conformity-assessment bodies are now working against to prepare their applications, and the reference clients should request from any Notified Body they engage.

3. ENISA SRP onboarding is live this month

ENISA has begun rolling out access and registration instructions, training materials and dry-run support for the Single Reporting Platform (SRP) throughout June 2026. The platform itself goes live on 11 September 2026, under 90 days from today. Manufacturers without an identified main-establishment CSIRT, an SRP authority contact and a tested reporting runbook are running out of preparation time.

What to do this week

• Re-confirm your Notified Body engagement targets and submit pre-engagement letters before Q3 ends.
• Pull ENISA’s competence requirements document and use it to qualify candidate Notified Bodies.
• Walk through ENISA’s June 2026 SRP onboarding materials and start the registration process now, rather than in September.

For the wider compliance picture, see our CRA compliance guide and the SBOM tutorial. For how the CRA sits alongside the EU’s other cybersecurity laws, read EU CRA vs DORA vs NIS2.

Sources

• European Commission: CRA Conformity Assessment
• European Commission: CRA Implementation page
• ENISA: Single Reporting Platform (SRP)
• ENISA: Technical Competence Requirements for CRA Notified Bodies

This article is general information about the EU Cyber Resilience Act, not legal advice, and reading it creates no advisory relationship. It reflects our reading of the regulation and the guidance available on the date shown above, both of which change. Classification, deadlines and obligations turn on the specific facts of your product. Verify against the primary sources before you rely on any of it, and take professional advice for decisions that carry legal or financial consequences. See our terms.