CE marking
The CE mark is familiar from machinery and electrical engineering. What is new is that from December 2027 it also attests to cybersecurity, and that pure software must carry it as well.
CE marking is the visible mark by which the manufacturer declares that a product meets the requirements of the applicable EU legislation. Under the Cyber Resilience Act, it attests for the first time to the cybersecurity of a product as well.
Definition in the Regulation
Article 3, point (31), of Regulation (EU) 2024/2847 defines CE marking as "a marking by which a manufacturer indicates that a product with digital elements and the processes put in place by the manufacturer are in conformity with the essential cybersecurity requirements set out in Annex I and other applicable Union harmonisation legislation providing for its affixing". Articles 29 and 30 govern how it is affixed. Article 13(12) requires the manufacturer to affix the CE marking once the conformity assessment has been completed and the EU declaration of conformity drawn up. Marking is therefore the last step before placing on the market. Importers check under Article 19(2), and distributors under Article 20(2), that the mark is present; if it is missing, the product must not be placed or made available on the market. Under recital 19, open-source software stewards may not affix CE marking.
What it means for manufacturers
For hardware manufacturers, little changes about the mark itself; what is new is what it stands for. From 11 December 2027, a product with digital elements may carry the CE mark only if the cybersecurity requirements of Annex I are also met and demonstrated. For software manufacturers, the mark is new: an app or desktop program cannot be printed on a housing, so under Article 30(1) the mark appears on the EU declaration of conformity or on the website accompanying the software product. A CE mark alone is not sufficient evidence in the supply chain; distributors must also check the declaration of conformity, user information and support end date. If a product has failed the conformity assessment, or should have been assessed by a notified body, the mark must not be affixed. Under Article 64(3), infringements of the CE marking rules in Article 30 fall into the second tier of fines, up to EUR 10 million or 2 per cent of total worldwide annual turnover; the framework applies from 11 December 2027.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit