The Compliance Relay · Version 0.4

How much CRA time do your engineers really have?

A regulation's deadline is not your engineers' deadline. Requirements pass through handoffs, wait on other teams, compete for people's time, and run into freezes, releases and audits. Add the constraints your organization actually has to see the real engineering window before the EU Cyber Resilience Act applies in full, whether the work fits, and when it must start.

The page opens with sample numbers so you can see how it works. They are not data from any organization. Replace them with your own, and add or remove anything that doesn't fit.

The clock

11 Dec 2027 is when the CRA's essential requirements apply in full. Any other regulatory deadline works the same way.

The work

Handoffs before engineers see it

Mark a step "runs alongside the step above" when the teams work in parallel. The EU asked for draft vulnerability-handling standards by 30 Aug 2026; formal citation usually takes months after that.

Dependencies on other teams

Weeks after the requirement reaches engineers before this team can start, because it is waiting on someone else.

Capacity

For example job cuts, other regulatory work or a competing launch, as a percentage of the team's time.

Planning

Blocked periods

Code freezes, release crunches, audit seasons, reorganizations: any time engineers cannot work on this.

Release and evidence

Engineering time left

0weeks of 0 on the calendar
—
—Latest date the first handoff must begin
—Requirement reaches engineers
—Engineering can start
—Real engineering deadline
—Capacity available for this work
Handoffs Waiting (standards or planning) Waiting on other teams Engineering Blocked Code complete to release Evidence and audit

Where the time goes

LossWeeksShare of calendar

Reduced capacity is shown as the engineering weeks it costs inside the working window; it does not appear on the timeline.

Win time back: start with the biggest loss