The 2026 EU Hardware Compliance Calendar: The Key Deadlines for CRA, Battery Reg, CBAM, DPP, PFAS and RoHS/REACH on One Page

Last updated: 17 October 2026. Compliance dates move: several below were amended or postponed in 2025–26, two of the regimes discussed here have no fixed date at all, and several more are subject to pending proposals. Verify the current position for your product before you rely on any date here.

The short version

A hardware company selling into the EU faces a stack of regulations, each with its own staggered dates. The distinction that matters for planning is between obligations dated in adopted law and items whose dating step (a delegated act or an adopted restriction) has not yet been taken. The Cyber Resilience Act (CRA), the Battery Regulation and the Carbon Border Adjustment Mechanism (CBAM) belong to the first group. The Digital Product Passport (DPP) for electronics and the EU-wide restriction on per- and polyfluoroalkyl substances (PFAS) belong to the second. A third group consists of standing requirements that are re-checked on a cycle, under the Restriction of Hazardous Substances Directive (RoHS) and the Registration, Evaluation, Authorisation and Restriction of Chemicals Regulation (REACH). Under the first three regimes, two central obligations on manufacturers and importers started to apply in 2026: CBAM's definitive regime on 1 January and the CRA reporting duty on 11 September. For a product that contains a battery, the next firm date is 18 February 2027. From then, portable batteries built into products must be removable and replaceable by the end user, subject to derogations, and a battery passport is required for light means of transport (LMT) batteries, electric vehicle (EV) batteries and large industrial batteries.

The master table

Status as of 17 October 2026.

The firm dates: plan around these

The regimes in this calendar fall broadly into three kinds. Some impose an obligation with a date already attached in adopted law. Some have no date yet, because the legal step that would give them one has not been taken. And some are standing requirements that recur on a cycle. The three regimes below are of the first kind, and their dates are the ones to plan around.

Cyber Resilience Act: since 11 September 2026, manufacturers have had to report any actively exploited vulnerability in their product and any severe incident affecting its security that they become aware of, simultaneously to the national computer security incident response team (CSIRT) designated as coordinator and to the EU cybersecurity agency ENISA, through ENISA's single reporting platform; the first step is an early warning within 24 hours of becoming aware (Regulation (EU) 2024/2847, Articles 14 and 71). The duty also covers in-scope products placed on the market before December 2027 (Article 69(3)). The full obligations (the essential cybersecurity requirements, conformity assessment and CE marking) apply from 11 December 2027. Scope is defined by data connection: the CRA applies to hardware and software products whose intended purpose or reasonably foreseeable use includes "a direct or indirect logical or physical data connection to a device or network" (Article 2(1)), so a wired data connection such as USB can bring a product into scope as well as a radio, and medical devices, motor vehicles and several other sectors under their own legislation are excluded. The CRA piece covers the detail.

EU Battery Regulation: if your product contains a battery, three duties arrive on 18 February 2027. The battery passport applies to LMT batteries, EV batteries and industrial batteries over 2 kWh. On the same date, anyone who places on the market a product incorporating portable batteries must ensure that the end user can readily remove and replace them, subject to the derogations in Article 11, and all batteries must have a QR code (Regulation (EU) 2023/1542, Articles 11, 13, 77 and 96). The removability duty falls on whoever places the device on the market, so it is a requirement on the design of the device itself. Supply-chain due diligence follows on 18 August 2027, after Regulation (EU) 2025/1561 postponed it from 18 August 2025; it currently exempts operators with net turnover below EUR 40 million that are not part of a group whose consolidated turnover exceeds that limit, and a pending simplification proposal would raise that threshold. The Battery Regulation piece covers the detail.

CBAM: the definitive regime has applied since 1 January 2026. Goods listed in Annex I (iron and steel, aluminium, cement, fertilisers, electricity and hydrogen, including some simple articles such as steel screws and bolts) may now be imported only by an authorised CBAM declarant, unless the importer's covered imports stay at or below 50 tonnes of net mass in the calendar year; that exemption does not extend to electricity or hydrogen (Regulation (EU) 2023/956 as amended by Regulation (EU) 2025/2083, Articles 2a and 4). The next dates are certificate sales from 1 February 2027 and the first annual declaration, for 2026 imports, by 30 September 2027. Finished electronics are outside Annex I today. That answer may change: the Commission's proposal COM(2025) 989 would extend CBAM from 1 January 2028 to about 180 steel- and aluminium-intensive downstream products, among them electric motors, transformers and some household appliances, and Parliament adopted amendments on 15 September 2026 and referred the file back to committee for negotiations with the Council. The CBAM piece covers the detail.

The moving targets: items for the watch list

Two regimes in this calendar have no date at all, and the reason is the same in both cases: the legal step that would turn each into a dated obligation has not been taken. For the Digital Product Passport that step is a delegated act for the product group, and none has been adopted for electronics. For PFAS it is the restriction itself, which is still a proposal under scientific assessment. Both belong on a watch list until that step is taken, which is the sense in which they are moving targets.

The Digital Product Passport for electronics: the DPP comes under the ESPR, which entered into force on 18 July 2024 and whose Working Plan 2025–2030, adopted on 16 April 2025, sets the direction. Under the ESPR, the DPP requirements for any given product group arrive only through later delegated acts, and as of October 2026 none has been adopted for an electronics product group. The Working Plan's years for electronics-related measures, such as horizontal repairability requirements and displays (both indicated for 2027), are indicative adoption years for those acts and impose no obligation in themselves. Under the ESPR, therefore, no electronics product group has a dated passport yet. The battery passport (18 February 2027) applies to LMT, EV and industrial batteries over 2 kWh, and sector laws add other passports, among them toys, electronic toys included, from 1 August 2030 under the new Toy Safety Regulation. Any specific year you may have read for a passport on phones, displays or chargers remains an expectation until a delegated act sets it. Track the delegated acts, and do not build to a date that no act has yet set.

PFAS: the proposed EU-wide restriction on PFAS ("forever chemicals") would cover the substance group broadly, and it remains a proposal. Five national authorities submitted it to ECHA in January 2023 (ECHA), and an updated version was published in 2025. The Commission expects ECHA's final scientific assessment by the end of 2026, after which it will present its own restriction proposal (European Commission, 15 June 2026). The universal restriction has no in-force date. On my reading of the steps still to come (a Commission proposal, a decision under REACH, and the transition periods and use-specific derogations a restriction of this breadth is likely to include), no obligation under it will fall due in 2026–27. Narrower restrictions on individual PFAS are separate from it and already adopted, among them those on PFOS, PFOA and PFHxS and, since 10 October 2026, on PFHxA in certain consumer uses (Commission PFAS page; Commission Regulation (EU) 2024/2462), so check your materials against those as well. The restriction belongs on your risk radar and in your design-for-substitution planning, because if it is adopted, substitution will take time.

The always-on regimes

The third kind consists of standing requirements that have to be re-checked on a cycle, so the calendar entry for each is a recurring check.

RoHS restricts ten hazardous substances in electrical and electronic equipment. As a standing requirement, it is tracked through its exemption-renewal cycle if you rely on an exemption: an application for renewal must be made at least 18 months before the exemption expires (Directive 2011/65/EU, Article 5(5)), and the exemptions in the Directive's Annexes III and IV, as amended, are what govern. Check those annexes themselves, since a summary may be out of date.

REACH runs in the background continuously. ECHA updates its SVHC Candidate List periodically, with no fixed schedule, and each update can pull a new substance into scope. If your articles contain a Candidate List substance above 0.1% by weight, you have had an obligation since 5 January 2021, under Article 9(1)(i) of the Waste Framework Directive (2008/98/EC), to notify SCIP, ECHA's database of substances of concern in articles (ECHA SCIP page). The Commission proposed in December 2025 to end that SCIP duty as part of its environmental simplification package (COM(2025) 986); as of October 2026 the proposal has not been adopted, and the obligation still applies. The proposal amends that Directive and leaves REACH unchanged, so the Article 33 duty to inform recipients of articles containing such a substance is unaffected. The calendar entry these regimes require is a cadence: check the Candidate List against your bill of materials each time it is updated.

Other dated EU regimes to check

This calendar covers the regimes above. Other EU rules with dates in 2024–28 also reach hardware, among them the Data Act's requirement that connected products placed on the market after 12 September 2026 be designed to make their data accessible to the user (Regulation (EU) 2023/2854, Articles 3(1) and 50), the Machinery Regulation (EU) 2023/1230 (applying from 20 January 2027), the cybersecurity requirements for radio equipment under Delegated Regulation (EU) 2022/30, as amended by Delegated Regulation (EU) 2023/2444 (applying since 1 August 2025), USB Type-C charging for laptops under the common-charger Directive (EU) 2022/2380 (since 28 April 2026), the General Product Safety Regulation (since 13 December 2024), the Packaging and Packaging Waste Regulation (since 12 August 2026), the ecodesign and energy-label rules for smartphones and tablets (since 20 June 2025), and the AI Act's high-risk requirements for AI in regulated products, which Regulation (EU) 2026/1744 moved to 2 August 2028. The list grows as acts are adopted, so check the rules for your own product category against EUR-Lex, the EU's official law portal.

FAQ

What is the next hard EU deadline for a connected product?

Among the regimes in this calendar, the CRA reporting duty is already in application: since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform, including for products already on the market. The next CRA date is 11 December 2027, when the full obligations and CE marking apply. If the product also contains a battery, 18 February 2027 comes first. Depending on the product, other regimes apply as well: the Data Act's design requirement already covers connected products placed on the market after 12 September 2026, and machinery comes under the Machinery Regulation from 20 January 2027.

Is the Digital Product Passport a 2026 or 2027 deadline?

For batteries it is a 2027 deadline: the battery passport applies from 18 February 2027 to LMT, EV and industrial batteries over 2 kWh. For electronics generally it is not yet a deadline at all: the DPP requirements come via ESPR delegated acts, none of which has been adopted for an electronics product group as of October 2026, so a fixed obligation exists only once a delegated act sets one. Track the ESPR delegated acts.

Do I need to act on PFAS now?

No deadline under the proposed universal restriction requires it, because that restriction is still a proposal with no in-force date. Narrower PFAS restrictions already adopted, such as those on PFOS, PFOA and PFHxS and, since 10 October 2026, on PFHxA in certain consumer uses, are separate and worth checking against your materials. The universal restriction is worth factoring into design and material choices now, however, because if a restriction is adopted, substitution takes time. Watch the ECHA opinions and the Commission proposal that follows them, and schedule nothing to the proposal itself.

Does CBAM affect me if I import electronics?

Today it usually does not. CBAM applies to the goods listed in its Annex I, which include iron, steel and aluminium and some simple articles made of them, such as fasteners, and finished electronics are not among them. Even for covered goods, an importer whose covered imports stay at or below 50 tonnes a year is exempt, except for electricity and hydrogen. The pending proposal to extend CBAM from 2028 includes some electrical goods, such as motors and transformers, so watch it if you import those. (See the CBAM piece.)

Which of these should a small hardware company prioritize?

Start with the firm regimes that touch your product. If it connects, the CRA reporting process is required now and the full CRA obligations follow in December 2027. If it contains a battery, prepare for removability and the QR code, and where relevant the passport, by February 2027. If you import steel, aluminium or other Annex I goods as such, check your annual tonnage against the CBAM threshold. Then check REACH's SVHC Candidate List against your bill of materials at each update, since that is the list that adds new substances without a fixed schedule. The DPP for electronics and PFAS belong on your watch list until the ESPR delegated acts and the universal PFAS restriction are adopted.

How often does this calendar change?

It changes often. In 2025–26 alone, the battery due-diligence date was postponed by Regulation (EU) 2025/1561, CBAM was amended by Regulation (EU) 2025/2083, the EU's corporate sustainability reporting and due-diligence rules were narrowed by Directive (EU) 2026/470, and the AI Act's high-risk dates were moved by Regulation (EU) 2026/1744. Treat this page as a dated snapshot, and re-check the firm dates, and especially the moving ones, at least twice a year. A safe habit is to re-confirm anything with a date against EUR-Lex or the relevant EU authority before you commit engineering effort or budget to it.

Close

A compliance calendar is useful when it separates the dates that bind from the items still pending, and when it shows where a binding date meets a part already in your bill of materials: the portable battery that has to become user-replaceable, the steel fastener you import as such and that counts toward the CBAM threshold, the module whose data port the product is meant to use and that brings it under the CRA. If you want to work out where these regimes meet your own product's architecture and supply base, particularly where parts come from China, I help with that kind of problem and look at hardware, firmware and sourcing together; get in touch if that question is open at your company.

Meritong is a China-sourcing and supply-chain strategy practice. I am not a licensed customs broker or attorney. This article provides general information; it does not give legal, customs or compliance advice. EU compliance dates and scopes change frequently, and several items above are proposals or depend on delegated acts. Check the current position for your specific products against EUR-Lex or with the relevant EU authority, and confirm it with qualified counsel before acting.