Cyber Resilience Act Response Center Request a demoDemo

News Updated

EN 40000-1-1 and EN 40000-1-2 have passed the formal vote, but no standard is in the Official Journal yet

According to consistent reports of 2 and 4 October 2026, the first two standards in the EN 40000 series have passed the vote at CEN and CENELEC; ratification has been announced for 2 November 2026. There is no confirmation from the official standards catalogue. For manufacturers, nothing changes for now.

Two specialist sources report that the standards EN 40000-1-1 (vocabulary) and EN 40000-1-2 (principles for cyber resilience) have passed the formal vote, the final vote of the national standardisation bodies at CEN and CENELEC. Ratification, the formal decision to publish them as European standards, is said to be scheduled for 2 November 2026. The information comes from the standards tracker craevidence.com (as of 2 October 2026) and the weekly briefing of aktriva.com (4 October 2026). Both refer to a social media post of 2 October 2026 by the convenor of the working group responsible. These are secondary sources. The official CEN catalogue could not be reached when we checked, and we have no confirmation from CEN or the Commission.

Some background: with standardisation request M/606, the Commission tasked the European standardisation organisations with drawing up around 41 standards for the Cyber Resilience Act. The EN 40000 series contains the horizontal foundations that apply to all products. Two of its four parts have now been approved. EN 40000-1-3 on vulnerability handling has completed the public enquiry and is in the approval phase; EN 40000-1-4 on general security requirements is still under development, with a delivery date of 30 October 2027.

What it means for manufacturers

In short: nothing yet. Three things separate an approved standard from a standard a manufacturer can rely on.

  • No standard in the Official Journal. A harmonised standard only takes effect once the Commission publishes its reference in the Official Journal of the EU. As of 7 October 2026, this had not happened for a single standard under the Cyber Resilience Act. The presumption of conformity under Article 27 of Regulation (EU) 2024/2847 is therefore still not available for any product. This is the presumption that a product meets the requirements of Annex I if it conforms to the standard.
  • The two standards may not confer a presumption at all. Citing information from CEN and CENELEC, the craevidence.com tracker notes that EN 40000-1-1 and -1-2 are not expected to be cited in the Official Journal. We were unable to verify where this note comes from.
  • Zero notified bodies. Manufacturers of important and critical products need a notified body for conformity assessment. Chapter IV of the Regulation has applied since 11 June 2026, yet up to the last documented check on 8 September 2026, no body for the Cyber Resilience Act had been entered in the NANDO database. Under Article 35(2), Member States are to strive to ensure that a sufficient number of notified bodies is available by 11 December 2026.

The deadlines of the standardisation request are also shifting: a Commission draft of July 2026 pushes the dates back by two months, to 31 October 2026 for the horizontal core standards and to 31 December 2026 for the vertical product standards. The corresponding decision has not yet been published in the Official Journal, so the new dates are proposed, not fixed. Which products require which procedure is explained in the guide Product classes and conformity assessment. Until the standards take effect, the technical guideline BSI TR-03183 remains the only benchmark from a public authority for vulnerability handling in Germany; it is voluntary.

For your readiness, this means: the reporting obligation under Article 14 does not wait for the standards. It has applied since 11 September 2026 and does not depend on whether a product was developed in line with a harmonised standard. CRA Response Center covers exactly this part, regardless of where standardisation stands: it recognises important reports sent to your reporting address, alerts the responsible people and records awareness and deadlines.

What remains open

The result of the formal vote is not documented in the official CEN catalogue; we rely on two secondary sources with the same primary source. It is open whether ratification will take place on 2 November 2026 and whether the Commission intends to cite the two standards in the Official Journal at all. For EN 40000-1-3, the most important standard for the reporting address and vulnerability handling, there is no date for the formal vote. When the first notified body will appear in NANDO is also unclear.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Sources

The reporting obligation already applies. Who answers at night at your company?

CRA Response Center monitors your security mailbox, recognises important reports using AI hosted in Germany (your e-mails never go to OpenAI, Anthropic or Google) and alerts your people by SMS and e-mail. EUR 190 per month including VAT. Try it free for 30 days.

Try it free for 30 days