Harmonised standard
Around 41 standards are to put the CRA into concrete terms. The first two are close to ratification; none is in the Official Journal. Until then, manufacturers carry the full burden of proof themselves.
A harmonised standard is a European standard that CEN, CENELEC or ETSI draw up at the request of the European Commission and whose reference is published in the Official Journal of the EU. Only with that publication does it give rise to the presumption of conformity.
Definition in the Regulation
Article 27(1) CRA refers to harmonised standards whose references have been published in the Official Journal. The basis for the CRA is standardisation request M/606, which the Commission issued in February 2025 by implementing decision C(2025) 618 and which the standardisation organisations accepted in April 2025; it covers around 41 standards. On the horizontal side, CEN-CENELEC/JTC 13 is working on the EN 40000 series: part 1-1 vocabulary, part 1-2 cyber resilience principles, part 1-3 vulnerability handling, part 1-4 generic security requirements. On the vertical side, the prEN 50770 series is being developed for OT products such as firewalls, VPNs, routers and SIEM, along with 17 ETSI drafts in the EN 304 6xx series.
As of October 2026: according to secondary sources, EN 40000-1-1 and 1-2 have passed the formal vote, with ratification announced for 2 November 2026; 1-3 is in the approval phase and 1-4 under development. No standard has been cited in the Official Journal. A Commission draft of July 2026 moves the delivery deadlines to 31 October 2026 (core standards) and 31 December 2026 (product standards); 30 October 2027 applies to the remaining standards. The draft has not been formally adopted.
What it means for manufacturers
As long as no standard has been cited, there is no presumption of conformity. Manufacturers of products in the default category carry out their own assessment under module A and justify their solutions in the technical documentation. Without a standard, manufacturers of important products in class I need a notified body under Article 32(2). The EN 40000 drafts are still worth reading: they show what evidence conformity assessment bodies and market surveillance will expect later on.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit