CRA Harmonised Standards: Status and Implications for Manufacturers
Harmonised standards are expected to play an important role in helping manufacturers demonstrate conformity with the EU Cyber Resilience Act. This article examines how the standards programme is structured, where development stands, and what manufacturers can do while the standards are being finalized.
This article was written by an SRES safety and cybersecurity expert with extensive experience supporting OEMs and suppliers in the development, validation, and assessment of safety-critical automotive and autonomous systems.
Looking to go deeper? Explore SRES’ EU Cyber Resilience Act (CRA) Training. For consulting support with CRA readiness and product cybersecurity, contact SRES at info@sres.ai.
Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), sets essential cybersecurity requirements for products with digital elements placed on the EU market. Annex I specifies outcomes such as secure-by-default configuration and the absence of known exploitable vulnerabilities, but it does not prescribe how those outcomes are to be achieved or demonstrated. That role is assigned to CRA harmonised standards, which, as of November 2026, remain under development.
This article outlines the function of harmonised standards under the CRA, the structure of the standardisation programme, its current status, and the preparatory measures available to manufacturers ahead of full application on 11 December 2027.
The role of harmonised standards
There are 41 harmonised standards and each standard is developed by either CEN, CENELEC or ETSI in response to a request from the European Commission. Once its reference is published in the Official Journal of the EU, application of the standard confers a presumption of conformity with the requirements it covers (Article 27 CRA). The manufacturer remains responsible for implementing and documenting the relevant measures, but is no longer required to justify from first principles its interpretation of requirements such as an “appropriate level of cybersecurity”.
In the absence of a cited standard, compliance remains possible, but each technical decision becomes a matter of interpretation that must be substantiated before market surveillance authorities or notified bodies.
Horizontal and vertical standards
The CRA standardisation programme follows a two-tier approach. Horizontal standards establish a common baseline for all products with digital elements, while vertical standards address the specific risks of individual product categories.
| Aspect | Horizontal standards | Vertical standards |
|---|---|---|
| Scope | Product-agnostic | Product-specific |
| Applicability | Every product with digital elements, regardless of category | Important (Annex III) and critical (Annex IV) product categories only |
| Content | Common framework, terminology, risk management method, lifecycle activities, vulnerability handling and generic security requirements | Concrete security requirements and assessment criteria for one product type, such as routers, password managers or smartcards |
| M/606 type | Type A (framework) and Type B (product-agnostic requirements) | Type C (product-specific) |
| Developed by | CEN-CENELEC JTC 13 | ETSI (EN 304 6xx), CENELEC (prEN 50770, EN 40001-3 to EN 40004-3), CEN/TC 224 (EN 40000-10, EN 40000-11, EN 18330) |
| Series | EN 40000-1-x | EN 304 6xx, prEN 50770 and related series |
The two tiers are designed to be applied together. Vertical standards build on the horizontal framework and must remain consistent with it, so they refine the horizontal baseline rather than replace it. For default products, which make up the majority of the market, the horizontal standards are the principal reference, as no vertical standard applies. For important and critical products, the relevant vertical standard is applied in addition to the horizontal standards.
For example, a router manufacturer would apply EN 40000-1-2 as the framework for risk management and lifecycle activities and EN 40000-1-3 for vulnerability handling. It would then apply EN 304 627 for the requirements specific to routers, modems and switches.
Impact on conformity assessment
Harmonised standards also determine which conformity assessment procedures are available, as summarised below.
| Product tier | Examples | Conformity route | Effect of a cited harmonised standard |
|---|---|---|---|
| Default | Most products with digital elements | Self-assessment (internal control) | Supports the presumption of conformity, self-assessment is available regardless |
| Important, Class I | Password managers, VPN products, routers, smart home hubs | Self-assessment only where harmonised standards, common specifications or a European certification scheme are applied (Article 32(2)), otherwise a notified body | Opens the self-assessment route |
| Important, Class II | Hypervisors and container runtimes, firewalls, IDS/IPS, tamper-resistant microcontrollers | Third-party assessment | Supports conformity, does not remove third-party assessment |
| Critical (Annex IV) | Hardware devices with security boxes, smart meter gateways, smartcards and secure elements | European cybersecurity certification where mandated; otherwise third-party routes | Supports conformity, does not remove certification or third-party requirements |
Certification under a European cybersecurity certification scheme offers a further route to the presumption of conformity (Article 27(8)), although no scheme has yet been recognised for the CRA.
The dependency of Class I products on harmonised standards is significant because notified bodies under the CRA are still being designated and capacity is expected to be limited. Delays in standardisation may therefore direct a substantial volume of products toward a conformity route with constrained availability.
The approach is well established in functional safety. EU machinery legislation relies on EN ISO 13849 and IEC 62061 in the same way, providing manufacturers with a recognised process and set of work products that lead to the presumption of conformity. The CRA seeks to establish comparable support for cybersecurity within a considerably shorter timeframe.
Structure of the standardisation programme
The programme is governed by standardisation request M/606, adopted by the Commission in February 2025 and accepted by CEN, CENELEC and ETSI in spring 2025. It covers approximately 41 harmonised standards: around 15 horizontal standards applicable to all products with digital elements, with the remainder addressing specific product categories.
| Layer | Scope | Responsible body | Series |
|---|---|---|---|
| Horizontal (Type A/B) | All products with digital elements: vocabulary, risk-based principles, lifecycle, vulnerability handling, generic security controls | CEN-CENELEC JTC 13 | EN 40000-1-x |
| Vertical, OT and network (Type C) | Industrial and network products: firewalls, IDS/IPS, VPNs, routers and switches | CENELEC | prEN 50770 series |
| Vertical, product-specific (Type C) | Annex III product categories, from routers and modems to connected toys | ETSI | EN 304 6xx series |
Additional work streams address chip and secure-element platforms (EN 40001-3 and related parts) and identity, access and hardware security topics within CEN/TC 224.
Horizontal standards
The EN 40000 series, drafted by CEN-CLC/JTC 13, builds on the EN 18031 series developed for the cybersecurity provisions of the Radio Equipment Directive. Organisations with experience of RED Article 3.3 compliance will therefore recognise much of its approach.
| Part | Type | Topic | Official Journal citation |
|---|---|---|---|
| EN 40000-1-1 | – | Vocabulary | Recorded by CEN-CENELEC as “no citation expected” |
| EN 40000-1-2 | A | Principles, product risk management and lifecycle activities | Recorded by CEN-CENELEC as “no citation expected” |
| EN 40000-1-3 | B | Vulnerability handling (Annex I Part II) | Citation anticipated, not yet confirmed |
| EN 40000-1-4 | B | Generic security requirements | Reported as “no citation expected” in CEN-CENELEC records, subject to change |
Citation is decided by the European Commission following assessment of the delivered standard. The indications above reflect CEN-CENELEC project records and published commentary as of early November 2026 and may change.
EN 40000-1-2 is the closest equivalent to a process standard under the CRA.
Vertical standards
The vertical standards draw substantially on the IEC 62443 series, which benefits organisations already established in industrial automation. However, several IEC 62443 parts are not expected to be cited in the Official Journal in their own right. Application of IEC 62443 alone will therefore not confer the presumption of conformity; the relevant CRA-specific European standard is required.
Current status (November 2026)
At the time of writing, no CRA harmonised standard has been cited in the Official Journal for any product category.
Delivery deadlines: The original August 2026 deadline passed without delivery. A draft amendment to Implementing Decision C(2025) 618, circulated by the Commission on 7 July 2026, proposed new dates, but the first of these, 30 October 2026, has also now passed. No adopted amendment and no confirmed delivery to the Commission had been publicly reported by early November 2026.
| Standard type | Scope | Original deadline (M/606) | Proposed deadline (draft amendment) | Status (early November 2026) |
|---|---|---|---|---|
| Type A | Framework (EN 40000-1-2) | 30 August 2026 (passed) | 30 October 2026 (passed) | Approved in CEN-CENELEC formal vote in October 2026, publication planned for late November 2026 |
| Type B | Vulnerability handling (EN 40000-1-3) | 30 August 2026 (passed) | 30 October 2026 (passed) | Formal vote pending |
| Type B | Generic security requirements (EN 40000-1-4) | 30 October 2027 | Not addressed | In drafting, not yet due |
| Type C | Product-specific standards | 30 October 2026 (passed) | 31 December 2026 | ETSI approval procedures concluding by mid-November 2026 |
These are delivery dates to the Commission, not citation dates. Each missed deadline reduces the time available to manufacturers for testing, documentation and, where required, notified body engagement. Where a requested standard is not delivered on time, Article 27(2) also allows the Commission to adopt common specifications, which carry the same presumption of conformity.
Horizontal standards: Approval and publication do not equate to citation. EN 40000-1-1 and EN 40000-1-2 are expected to serve as essential reference material without themselves providing a presumption of conformity, leaving EN 40000-1-3 as the first horizontal part anticipated to be cited.
Vertical standards: In mid-2026 ETSI submitted 17 final draft vertical standards (EN 304 6xx series), covering Annex III product categories from routers to connected toys, to public enquiry. The approval procedures conclude between mid-September and mid-November 2026, depending on the draft, and the enquiry drafts are freely available. EN 304 627, covering routers, modems and switches, is among the most advanced. On the CEN-CENELEC side, the prEN 50770 operational-technology profiles remain in drafting, while the chip, secure-element and identity standards have completed public enquiry. Drafts for certain critical product categories are developed in a restricted setting and are not publicly available.
Supporting measures:
| Measure | Status |
|---|---|
| Article 26 guidance on scope and application | Content approved by the Commission in July 2026 |
| ENISA single reporting platform | Operational since 11 September 2026 |
| Reporting of actively exploited vulnerabilities and severe incidents | Applicable since 11 September 2026 |
| Notified bodies | Designation by member states in progress |
Key milestone: The relevant date for manufacturers is not the drafting deadline but the date of citation in the Official Journal. Following delivery, each standard must be assessed by the Commission before citation, a step that has historically taken several months. Standards due for delivery in late 2026 may consequently not become usable until well into 2027, while the principal CRA obligations apply from 11 December 2027 irrespective of standardisation progress.
Recommended preparatory measures
Most CRA compliance activities do not depend on the final content of the cited standards. The following measures are recommended:
| Measure | Recommended action |
|---|---|
| Confirm product classification | Determine whether the product is default, Class I, Class II or critical, as this fixes the conformity route more directly than any standard. Class I products intended for self-assessment require a contingency plan in case the relevant standard is not cited in time. |
| Align with mature drafts | Review EN 40000-1-2 (approved, publication pending), prEN 40000-1-3 and the applicable ETSI or prEN 50770 vertical, and use them as the basis for a gap assessment. Drafts that have completed public enquiry rarely change substantially before publication. |
| Complete standard-independent activities | Prepare the product cybersecurity risk assessment, a machine-readable SBOM, a vulnerability-handling process and complete technical documentation, all of which are required under every conformity route. |
| Verify reporting readiness | Confirm that the 24-hour early warning process for actively exploited vulnerabilities is operational; this obligation has applied since 11 September 2026 and is unaffected by standardisation delays. |
| Engage notified bodies early | Establish contact in advance to secure capacity should third-party assessment become necessary. |
| Participate in standardisation | Where enquiry periods remain open, submit comments through national standardisation bodies, whose internal deadlines precede those of ETSI. |
Organisations already applying ISO/SAE 21434, IEC 62443 or an established secure development lifecycle should map existing processes to the EN 40000 structure rather than establish new ones. The principal gap is typically traceability between activities and individual Annex I requirements.
Conclusion
Harmonised standards translate the CRA’s essential requirements into specific technical criteria that can be implemented and assessed. Although none has yet been cited in the Official Journal, the direction of the programme is clear and mature drafts are publicly accessible. Manufacturers that use the intervening period to align with these drafts and complete standard-independent activities will be well positioned when citations are published. Those that defer preparation until final publication face an increased risk of conformity assessment delays as the December 2027 deadline approaches.
Sources
Cyber Resilience Act: current state of play, cyberresilienceact.eu
Draft amendment pushes CRA standard deadlines back two months, cyberresilienceact.eu
What are CRA harmonised standards? Status and tracker, CRA Evidence
Have insights or questions? Send us an email at info@sres.ai or leave a comment below. We welcome thoughtful discussion from our technical community.
Interested in learning more about our approach? Explore why teams choose SRES training and how we support organizations with Automotive consulting and Physical AI consulting.
