IEC 62443
Many machinery and component manufacturers have long worked to IEC 62443. That is a good foundation for the CRA, but not a free pass: the series is not a harmonised standard.
IEC 62443 is an international series of standards for the cybersecurity of industrial automation and control systems. For manufacturers, the most relevant parts are 4-1 on the secure development process and 4-2 on the technical requirements for components.
Definition in the Regulation
The CRA does not mention IEC 62443. In Article 27, the Regulation ties the presumption of conformity exclusively to harmonised standards whose references are published in the Official Journal of the EU, or to common specifications and European cybersecurity certification schemes. IEC 62443 is an international standard without a Commission standardisation request and without citation in the Official Journal. It therefore gives no presumption of conformity, not even for those parts of Annex I whose content it covers.
What it means for manufacturers
As no harmonised CRA standard has been published in the Official Journal as of October 2026, manufacturers of products in the default category have to describe and justify their own solutions in the technical documentation (Annex VII, point (5)). IEC 62443-4-1 and 4-2 are useful guidance for this, just like BSI TR-03183-1. A documented development process under 4-1 and component requirements under 4-2 cover many points of Annex I, Parts I and II, such as risk assessment, secure default configuration, update mechanisms and vulnerability handling. What is missing is legal effect: market surveillance can examine whether each measure is adequate. For important products in class I, IEC 62443 does not replace the harmonised standard that Article 32(2) requires for the module A route. Manufacturers already certified to IEC 62443 should map their evidence to Annex I and close the gaps, rather than presenting the certification as CRA conformity.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Harmonised standard
- Presumption of conformity
- BSI TR-03183
- Annex I (essential cybersecurity requirements)