CRA harmonised standards: which ones apply to your electronic product

The conformity assessment route depends on two factors: the product's classification and whether the manufacturer applies a harmonised standard published in the OJEU.

Default products: the standard conformity assessment route is self-assessment through internal control (Module A). The manufacturer may also voluntarily choose a more stringent route involving third-party assessment, but Module A is the baseline. 

Important Class I products: applying a harmonised standard cited in the OJEU allows the manufacturer to use self-assessment. Without it, the manufacturer must involve a Notified Body or demonstrate conformity through a European cybersecurity certification scheme. The cost and timeline difference between these routes is substantial.

Important Class II and Critical products: third-party conformity assessment is mandatory regardless of whether harmonised standards are applied.

For connected electronic products that fall into the default or Important Class I categories, which account for a very significant share of the connected electronics placed on the EU market, following the relevant harmonised standard is the most direct way to demonstrate compliance.

If the standards are not harmonised by the time the CRA becomes fully applicable on 11 December 2027, manufacturers of Important Class I products would need to use the third-party assessment route until harmonisation occurs. This is a timeline risk that manufacturers should factor into their compliance planning.

The Commission's Standardisation Request M/606 organises the CRA standards into horizontal standards and vertical standards. The former apply to any product with digital elements regardless of its category, while the latter set out the requirements for specific categories.

The horizontal EN 40000 series, developed by CEN-CLC JTC 13 Working Group 9, consists of four parts that work together.

For manufacturers whose product portfolio spans multiple categories, this architecture means the horizontal framework is the same across all products. The variation sits in the vertical layer, where product-specific requirements are calibrated to the risk profile of each category.

This section maps the vertical standards to the product categories they cover. Each standard addresses one or more product types listed in Annex III or IV of the CRA.

The vertical standards do not all follow the same technical approach. The standards landscape splits into two distinct methodological families, and understanding which one applies affects how a manufacturer prepares.

The majority of verticals, developed by ETSI TC CYBER, cover product categories such as routers, smart home devices, wearables and firewalls. These standards build on the EN 18031 security controls methodology: the security requirements are structured as selectable controls mapped from threats and security objectives, with applicability determined by the product's risk assessment. Manufacturers with RED Article 3.3 experience will recognise this approach.

A smaller group of verticals, developed primarily by CEN TC 224 and CENELEC TC 47X, covers products where hardware-level security is the defining characteristic: secure elements, smartcards, hardware security modules and tamper-resistant components. These standards use ISO/IEC 15408 (Common Criteria) as their requirements and evaluation framework. The security requirements are structured as Security Functional Requirements (SFRs) and evaluated through a Common Criteria methodology, with risk profiling determining the applicable assurance level.

The distinction matters for two practical reasons. First, it determines which prior compliance evidence is reusable: EN 18031 evidence maps directly to ETSI-based verticals, while Common Criteria certifications and evaluations map to the CEN/CENELEC verticals for security hardware. Second, the evaluation methodology and the type of evidence required differ between the two families, which affects how the manufacturer should structure the conformity assessment.

If your product does not have the core functionality of any category listed in Annex III or IV, it is a default product. Default products follow the horizontal EN 40000 series: EN 40000-1-2 for the development process, EN 40000-1-4 for the security control requirements, and EN 40000-1-3 for vulnerability handling. No vertical standard is required, and the horizontal standards are the compliance path.

Manufacturers who have already worked with the EN 18031 standard series for RED Article 3.3 cybersecurity compliance are in a stronger position than they may realise.

EN 18031 was developed using IEC 62443-4-2 and ETSI EN 303 645 as its primary inputs. The CRA standards, particularly the horizontal EN 40000-1-4 and the ETSI vertical standards, use EN 18031 as the starting baseline. The Standardisation Request M/606 explicitly acknowledges this lineage.

In practice, this means that the security controls, the risk-based approach to determining applicability, and much of the technical methodology that manufacturers applied under EN 18031 carry forward into the CRA standards framework. A manufacturer who has built a product against EN 18031-1 (for internet-connected radio equipment) will find that the security control structure and methodology are familiar territory, extended to cover the broader scope of the CRA.

What changes is the scope (the CRA covers all products with digital elements, not only radio equipment), the lifecycle requirements (ongoing vulnerability handling under EN 40000-1-3, which has no direct equivalent under the RED compliance model), and the conformity assessment structure (the CRA introduces its own product classification and assessment routes). But the core technical security requirements are an evolution, not a revolution, for manufacturers already working with EN 18031.

For manufacturers who have not yet engaged with EN 18031 or who are approaching CRA compliance without prior RED 3.3 experience, the ETSI EN 303 645 (cybersecurity for consumer IoT) can also serve as a useful reference point. While it is narrower in scope than the CRA standards, it covers many of the same security principles and was one of the foundational inputs for both EN 18031 and the CRA horizontal standards.

*For how the cybersecurity risk assessment under the CRA differs from the regulatory risk assessment in your CE marking technical file, see Regulatory vs. CRA cybersecurity risk assessment

If EN 18031 is the bridge to the CRA for manufacturers of radio equipment, the EN IEC 62443 series plays an equivalent role for manufacturers of industrial electronics, operational technology, and control system components.

The IEC 62443 series is widely adopted in industrial environments and critical infrastructure sectors. For manufacturers already working within this framework, the connection to the CRA is direct: several CRA vertical standards are being developed by CENELEC on the basis of IEC 62443, and the core parts of the series map well against the CRA essential requirements.

Three parts of the series are directly relevant:

Both EN IEC 62443-4-1 and EN IEC 62443-4-2 are receiving European amendments (A11:2026) specifically to close the gaps identified between the existing standard content and the CRA essential requirements. These amendments ensure that the IEC 62443-based path aligns with what the CRA requires, without requiring manufacturers to abandon a framework they already use.

CENELEC TC 65X is developing CRA vertical standards based on the IEC 62443 series for several product categories that overlap with the ETSI EN 304 6xx series but are specifically oriented to industrial use:

VPN products, network management systems, SIEM systems, physical and virtual network interfaces, routers, modems, and switches, and firewalls and intrusion detection/prevention systems intended for industrial use.

For manufacturers whose products fall into these categories and are primarily intended for industrial or operational technology environments, the IEC 62443-based verticals from CENELEC TC 65X may be the more natural fit compared to the ETSI equivalents, because they build on the same security architecture and terminology that the manufacturer already uses.

The IEC 62443 series also includes EN IEC TS 62443-1-5, which defines a scheme for security profiles: subsets of IEC 62443 requirements mapped to specific application domains, product types, or operational environments. This mechanism allows the development of product-specific or sector-specific profiles that can serve as the basis for CRA vertical standards without rewriting the entire framework for each product category.

Manufacturers who have already certified products or processes under IEC 62443 (through IECEE CB Scheme for instance) have accumulated evidence that is directly relevant to CRA compliance. The security controls documented under IEC 62443-4-2, the development lifecycle evidence from IEC 62443-4-1, and the system-level security architecture from IEC 62443-3-3 can all be mapped against the CRA essential requirements.

This does not mean that IEC 62443 certification equals CRA compliance. The CRA has its own conformity assessment structure, its own product classification, and specific requirements (such as the SBOM obligation and the vulnerability reporting obligation under Article 14) that IEC 62443 does not cover. But the technical security evidence and the process maturity built under IEC 62443 provide a substantial head start, particularly for the Annex I Part I requirements.

✅ Identify your product's classification first. Before determining which standards to follow, establish whether your product falls into the default category, Important Class I, Important Class II, or Critical. The CRA Implementing Regulation (EU) 2025/2392 sets out the technical descriptions of the categories. This classification determines both the conformity assessment route and whether a vertical standard applies to your product.

✅ The horizontal framework applies to everyone. Regardless of classification, the EN 40000 series provides the baseline. EN 40000-1-2 (development process) and EN 40000-1-3 (vulnerability handling) apply to all products. For default products, EN 40000-1-4 provides the security control requirements. For products with a vertical standard, the vertical replaces EN 40000-1-4 with product-specific requirements.

✅ Not all horizontal standards are designed for harmonisation. EN 40000-1-2 (secure development process) and EN 40000-1-4 (generic security requirements) are not conceived to be harmonised against the CRA. This means that applying them will not trigger a presumption of conformity with the essential requirements they cover. They do, however, represent the state of the art in their respective areas: EN 40000-1-2 for secure product development practices and EN 40000-1-4 for the mapping between CRA essential requirements and implementable security controls. For manufacturers, this has a practical consequence: these standards remain the most authoritative technical reference for demonstrating compliance with the development process and product security requirements, even though the legal shortcut of presumption of conformity does not apply. The manufacturer's technical documentation should explain how compliance is achieved, and basing that explanation on the methodology and controls defined in these standards is a sound technical approach.

✅ Monitor the standardisation delivery timeline. Standardisation Request M/606 sets delivery deadlines for the ESOs: EN 40000-1-2 and EN 40000-1-3 by 30 August 2026, the vertical standards by 30 October 2026, and EN 40000-1-4 by 30 October 2027. These are delivery dates to the Commission, not publication dates in the OJEU. After delivery, standards go through formal adoption, publication and citation in the Official Journal before they can trigger the presumption of conformity. This process has historically taken additional months. For Important Class I products, the availability of a harmonised vertical standard in the OJEU by 11 December 2027 determines whether self-assessment is an option from day one.

✅ Start working with the drafts now. The ETSI vertical standard drafts under the EN 304 6xx series are available on the ETSI website free of charge. These are working drafts, not final published standards, and their content may change before publication. CEN-CENELEC drafts are accessible through the public enquiry process of the national standardisation bodies. Despite the draft status, the technical content is mature enough to design against, and waiting for final publication before engaging with the requirements creates unnecessary time pressure.

✅ Standards are voluntary, but the alternative is more expensive. Manufacturers are not obligated to follow harmonised standards. They can demonstrate compliance with the essential requirements through other technical means. However, for Important Class I products, not following a harmonised standard means mandatory third-party assessment instead of self-assessment, with the associated cost and timeline implications.

✅ Partial application provides partial presumption. If a manufacturer applies a harmonised standard but not in full, the presumption of conformity applies only to the essential requirements covered by the applied parts. The manufacturer must demonstrate compliance with the remaining requirements through other means and document the approach in the technical documentation. This is consistent with how partial application of harmonised standards works under other CE marking directives.

For support with CRA compliance planning and gap assessment, see the Compliance Gap Assessment and External Compliance Manager services.