EU AI Act & Cyber Resilience Act: Key Dates, Scope, Resources

The EU AI Act and Cyber Resilience Act (CRA) are two landmark regulations that set binding requirements for artificial intelligence systems and digital products with digital elements sold in the EU. This article explains the key dates, scope, and official resources for both laws, so you can quickly determine which one applies to your product and what you need to do to comply.

Background: Why the EU Created These Two Laws

The EU introduced the AI Act and the Cyber Resilience Act as complementary pieces of legislation. The AI Act focuses on the risk posed by the use of AI – for example, whether a system is used for biometric surveillance or credit scoring. The CRA focuses on the cybersecurity of products with digital elements – such as smart cameras, routers, and software platforms – regardless of whether they use AI. Together, they aim to make the EU market safer and more trustworthy for digital products.

The AI Act was proposed in April 2021 and the CRA in September 2022. Both went through the EU’s ordinary legislative procedure, involving the European Commission, Parliament, and Council. The final texts were published in the EU’s Official Journal in 2024, and their requirements are being phased in over several years to give businesses time to adapt.

Key Dates: When Do the Rules Apply?

Here are the most important dates for both regulations. Note that many obligations start later than the entry into force.

• AI Act – Entry into force: 1 August 2024 (20 days after publication in the Official Journal).
• AI Act – Prohibitions on unacceptable risk: 2 February 2025 (6 months after entry into force).
• AI Act – General-purpose AI (GPAI) obligations: 2 August 2025 (12 months after entry into force).
• AI Act – High-risk AI systems (Annex III) and most other provisions: 2 August 2026 (24 months after entry into force).
• AI Act – High-risk AI systems listed in Annex I (e.g., safety components of products): 2 August 2027 (36 months after entry into force).
• CRA – Entry into force: 11 December 2024 (20 days after publication).
• CRA – Reporting obligations for actively exploited vulnerabilities and incidents: 11 September 2026 (21 months after entry into force).
• CRA – Most other obligations (e.g., conformity assessment, CE marking): 11 December 2027 (36 months after entry into force).

These dates are set in the legal texts. Always check the official versions for any amendments.

Scope: Which Products and Systems Are Covered?

The scope of each law is different, but there is some overlap.

AI Act Scope

The AI Act applies to providers, deployers, importers, and distributors of AI systems placed on the EU market or used in the EU. An “AI system� is defined broadly as a machine-based system that can, for a given set of objectives, generate outputs such as predictions, content, recommendations, or decisions influencing environments. The law categorizes AI by risk:

• Unacceptable risk: AI systems that manipulate human behaviour or exploit vulnerabilities (e.g., social scoring by governments) are prohibited.
• High risk: AI used in critical infrastructure, education, employment, essential services, law enforcement, migration, and justice – subject to strict requirements.
• Limited risk: AI like chatbots and deepfakes – transparency obligations only.
• Minimal risk: Most other AI – no extra obligations.

Note that AI systems used solely for military, defence, or national security purposes are outside the scope.

CRA Scope

The CRA applies to “products with digital elements� – any product or software that is connected to a device or network, including hardware and software. This includes smart home devices, IoT products, operating systems, and standalone software. There are exemptions for:

• Products already covered by other EU sectoral rules with similar cybersecurity requirements (e.g., medical devices, aviation, automotive).
• Products developed exclusively for national security or defence.
• Free and open-source software that is not commercialized (but if you sell it or provide it as a paid service, it is covered).

The CRA classifies products into four categories: default (low risk), Class I, Class II, and critical – with increasing conformity assessment requirements.

How to Determine Which Law Applies to Your Product

If your product uses AI, you likely need to comply with both laws. Here is a simple decision process:

1. Is it an AI system? If yes, check the AI Act risk categories. If it is high-risk, you will have to meet requirements like risk management, data governance, technical documentation, and human oversight.
2. Is it a product with digital elements? If yes, check if it falls under the CRA’s exemptions. If not, you must meet essential cybersecurity requirements, such as secure-by-default, vulnerability handling, and reporting.
3. If both apply: You must satisfy both sets of obligations. The CRA explicitly states that it complements the AI Act, and the AI Act’s requirements for high-risk AI are considered as part of the CRA’s “essential requirements� for cybersecurity.

For example, a smart doorbell with facial recognition is an AI system (high-risk if used for biometric identification) and a product with digital elements (so it must also be cyber secure).

Common Problems and Misconceptions

One common misconception is that the AI Act applies to all AI, including simple rule-based systems. In reality, the definition is limited to machine-based systems that can learn or reason – a simple calculator is not an AI system. Another misconception is that the CRA only covers hardware. It explicitly covers standalone software, including apps and cloud services.

A frequent practical problem is that companies underestimate the time needed for conformity assessment. For high-risk AI, you need to have a quality management system, technical documentation, and sometimes a notified body assessment – which can take months. Similarly, for CRA Class II products, you need to involve a notified body, which can be a bottleneck.

Another issue is that the CRA requires you to report actively exploited vulnerabilities and incidents to ENISA (the EU Agency for Cybersecurity) within 24 hours for incidents and 72 hours for vulnerabilities – this is a tight timeline that many organizations are not prepared for.

Official Resources and How to Stay Updated

For the most accurate and up-to-date information, always refer to official EU sources:

• EUR-Lex – the official EU law database. Search for “Regulation (EU) 2024/1689â€� (AI Act) and “Regulation (EU) 2024/2847â€� (CRA) to read the full legal texts.
• European Commission – AI Act webpage – provides guidance, FAQs, and the AI Act’s timeline.
• European Commission – Cyber Resilience Act webpage – includes the regulation, FAQs, and supporting documents.
• European Artificial Intelligence Board (EAIB) – will provide guidance and best practices.
• ENISA – for CRA-related cybersecurity requirements and reporting procedures.
• National competent authorities – each EU member state will designate authorities for enforcement; check your national regulator’s website.

Be cautious of non-official summaries – they may be outdated or inaccurate. The Commission regularly publishes implementing acts and guidance, so check those pages periodically.

Frequently Asked Questions

Do I need to comply with the AI Act if my AI is open-source?

Yes, but with some exceptions. The AI Act exempts AI systems released under a free and open-source licence, unless they are placed on the market or put into service as a high-risk system, or as a prohibited practice, or as a general-purpose AI model with systemic risk. So if you develop an open-source AI model that is clearly not high-risk, you may not need to comply with most obligations.

What is the penalty for non-compliance with the AI Act?

Fines can be up to €35 million or 7% of global annual turnover for prohibited practices, €15 million or 3% for most other violations, and €7.5 million or 1.5% for supplying incorrect information. These are maximum amounts; actual fines depend on the case.

Does the CRA apply to software updates after a product is placed on the market?

Yes. The CRA requires manufacturers to ensure that vulnerabilities are handled for the expected lifetime of the product, or for at least 5 years after placing on the market. Security updates must be provided for that period, and they are considered part of the product’s conformity.

Can a small business get an exemption from the CRA?

No, the CRA does not have a general exemption for small businesses. However, it does have some lighter requirements for micro and small enterprises, such as reduced documentation and simplified conformity assessment procedures. You still need to meet the essential requirements.

How do I get a CE mark under the CRA?

For most products, you can self-assess against the essential requirements and draw up an EU declaration of conformity, then affix the CE mark. For Class II and critical products, you must involve a notified body. After that, you need to register the product in a central database (the European cybersecurity certification framework).

Where can I find the official text of the AI Act and CRA?

Both are published in the Official Journal of the EU and are available on EUR-Lex. Search for “Regulation (EU) 2024/1689� for the AI Act and “Regulation (EU) 2024/2847� for the CRA. The European Commission’s website also hosts the final texts and related guidance.

Related

• What Happens When Matter and Antimatter Meet?
• iPhone Screen Recording iOS 11: How to Use It
• Best Free & Low-Cost eSIMs for Travel: What to Compare

in t | Finish time | min | 50 | 0
in d | Distance | km | 10 | 0
out pace | Average pace | min/km | t / d | 2
out speed | Average speed | km/h | d / (t / 60) | 2