Harmonised Standards Under the CRA
The European Commission has requested 41 harmonised standards via standardisation request M/606. These follow a three-tier hierarchy — from broad principles (Type A) to product-specific requirements (Type C). Understanding this framework is essential for choosing the right conformity route.
Important: As of April 2026, no harmonised standards have been officially published in the EU Official Journal for the CRA. The base standards described on this page (IEC 62443, EN 303 645, etc.) in their current published form do NOT provide a presumption of conformity. They require specific amendments to become suitable harmonised standards.
The Three-Tier Standards Hierarchy
CRA harmonised standards follow a model similar to the Machinery Regulation: from broad framework principles to product-specific requirements.
Type A — Basic Standard
The foundation of the CRA standards landscape. Specifies core principles for cyber resilience and translates the first line of Annex I: products shall ensure an appropriate level of cybersecurity based on risks.
All products with digital elements, regardless of category
- Defines core concepts and the framework that Type B and C must follow
- Does not itself provide presumption of conformity
- Draft exists; CEN/CENELEC enquiry started late August 2025
All manufacturers of products with digital elements
Type B — Horizontal Standards
Cross-cutting cybersecurity requirements applicable to multiple product types. Split into two categories: vulnerability handling and generic technical requirements.
Product-agnostic — applies across categories
- Vulnerability handling standards cover discovery, triage, remediation, coordination and disclosure
- Generic cybersecurity standards cover technical measures like access control, encryption, secure updates
- Can partially provide presumption of conformity, but are often too generic for full coverage
All manufacturers — Type B standards are the bridge between principles and product-specific rules
Type C — Vertical / Product-Specific Standards
Standards for specific product categories from CRA Annex III (Important) and Annex IV (Critical). Following the Type C standard for your product provides presumption of conformity.
Specific product categories — the standard that matters most for your compliance
- Provides presumption of conformity when correctly applied
- Must not deviate from Type A/B principles unless justified (coherence principle)
- Parallel standards exist for some product types — e.g., routers have both a CENELEC (industrial OT) and ETSI (consumer) variant
Manufacturers of specific product categories listed in Annex III and IV
Base Standards Require Amendments
The existing international standards listed below form the technical foundation for the upcoming harmonised standards. However, in their current published form, they are not suitable as harmonised standards under the CRA. Each requires specific amendments to align with the CRA essential requirements in Annex I.
- Using IEC 62443 or EN 303 645 today is good practice but does NOT give presumption of conformity under the CRA
- Amendments (e.g., A11:2026 for IEC 62443) must map standard clauses to specific CRA Annex I requirements
- The amended European (EN) versions may differ from the international (IEC/ISO) versions
- Formal citation in the Official Journal of the EU is required before presumption of conformity applies
- The European Commission can establish common specifications via implementing acts if standards are delayed
Base Standards Being Adapted
These existing standards form the technical foundation. Each is being adapted through amendments to become a harmonised standard under the CRA.
Horizontal Standards (Type B basis)
EN 18031 series
Type B Deadline: 30 October 2027EN 18031 Parts 1-3 — Common security requirements for radio equipment
Originally developed for the Radio Equipment Directive (RED). Harmonised under RED in January 2025 — the first harmonised cybersecurity standard in the EU.
- • Part 1: Network protection for internet-connected radio equipment
- • Part 2: Personal data and privacy protection (IoT toys, wearables, smart home)
- • Part 3: Fraud prevention for equipment processing virtual currencies
33 requirements across 11 groups: access control, authentication, secure storage, encrypted communication, resilience, network monitoring, cryptography
Probable basis for the Type B horizontal standard for generic cybersecurity requirements
Amendments pending to align with CRA Annex I essential requirements
EN ISO/IEC 29147
Type B Deadline: 30 August 2026EN ISO/IEC 29147 — Vulnerability disclosure
International standard for external vulnerability disclosure processes.
How a manufacturer receives vulnerability reports from third parties, processes them, and publishes advisories. Includes guidance for disclosure policies, reporting channels, and coordinating publication timing.
Basis for the vulnerability handling component of the Type B standard. The CRA requires a published CVD policy (Annex I, Part II, section 5).
Being adapted for CRA alignment
EN ISO/IEC 30111
Type B Deadline: 30 August 2026EN ISO/IEC 30111 — Vulnerability handling processes
International standard for internal vulnerability handling.
Internal process from receipt and verification through impact analysis and prioritisation to developing and deploying a fix. Together with ISO 29147, this covers the complete vulnerability lifecycle: internal handling (30111) and external communication (29147).
Basis for the vulnerability handling Type B standard. Directly relevant for the CRA reporting obligation taking effect 11 September 2026.
Being adapted for CRA alignment
EN 17640
Type B Deadline: 30 October 2027EN 17640 — Fixed-time cybersecurity evaluation methodology
European standard for pragmatic cybersecurity evaluations within a fixed timeframe.
Unlike full Common Criteria evaluation (which can take months to years), EN 17640 offers a proportionate approach suitable for faster time-to-market. Supports different assurance levels adapted to product risk profile.
Potential basis for evaluation methodology in conformity assessments. Supports both self-assessment and third-party evaluation.
Being evaluated for CRA alignment
EN 18037
Type B Deadline: 30 October 2027EN 18037 — Guidelines on sectoral cybersecurity assessment
European guidelines for sector-specific cybersecurity assessments.
Helps organisations translate generic CRA requirements to their specific sector context and product type. Particularly useful for sectors where no vertical Type C standard is yet available.
Supporting standard for sector-specific risk assessments. Bridges the gap until all Type C standards are available.
Under development
Vertical Standards (Type C basis)
EN IEC 62443 series
Type C CENELEC — TC 65X WG3EN IEC 62443 — Security for Industrial Automation and Control Systems
The international standard for cybersecurity of industrial automation and control systems (IACS). Developed by ISA, adopted by IEC. The most comprehensive OT cybersecurity standard available.
- • IEC 62443-4-1: Secure product development lifecycle — threat modelling, secure coding, security testing
- • IEC 62443-4-2: Technical security requirements for components — 7 foundational requirements with Security Levels (SL 1-4)
- • IEC 62443-3-3: System security requirements and security levels
- • IEC 62443-2-4: Security requirements for IACS service providers
Basis for all 13 vertical Type C standards for OT/IACS products from CENELEC. IEC 62443 certification also provides internationally recognised compliance outside Europe.
CENELEC TC 65X WG3 is developing A11:2026 amendments for parts 4-1 and 4-2 to align with CRA essential requirements. The European EN versions will differ from the international IEC versions.
ETSI EN 303 645
Type C ETSI — TC CYBER WG EUSRETSI EN 303 645 — Cyber Security for Consumer Internet of Things
The first globally applicable cybersecurity standard for consumer IoT devices (published 2020). Also adopted internationally as basis for national legislation in the UK (PSTI Act), Singapore, Finland and Australia.
- • 13 cybersecurity categories with 68 provisions (33 mandatory, 35 recommended)
- • Key requirements: no default passwords, vulnerability disclosure policy, secure updates, encrypted communication, minimised attack surface
Basis for the 18 vertical Type C standards from ETSI for consumer products (EN 304 6xx series). ETSI TC CYBER WG EUSR builds product-specific vertical standards on top of EN 303 645.
Under revision by ETSI TC CYBER to extend coverage to full CRA Annex I scope
Common Criteria (ISO/IEC 15408)
Type C CEN — TC 224 WG17 / TC 47X WG02-03EN ISO/IEC 15408 — Common Criteria for IT Security Evaluation
The internationally recognised framework for IT security evaluation. Globally recognised via the Common Criteria Recognition Arrangement (CCRA). In the EU, the EUCC certification scheme operates under the EU Cybersecurity Act.
- • Protection Profiles (PP): security requirements for a product category
- • Security Targets (ST): product-specific security claims
- • Evaluation Assurance Levels (EAL 1-7): from functionally tested to formally verified design
Basis for vertical Type C standards from CEN for critical products. The EC is working on a Delegated Act linking EUCC certification to presumption of conformity under the CRA (expected Q4 2026).
Mapping to CRA essential requirements being developed
Vertical Standards by Organisation
Three European Standardisation Organisations (ESOs) are developing product-specific Type C standards. Note: for products like routers and VPNs, parallel standards exist — one from CENELEC for industrial OT and one from ETSI for consumer products. The correct standard depends on the application domain.
ETSI
18 standardsTC CYBER WG EUSR
Basis: EN 303 645 / EN 304 6xx series
CENELEC
13 standardsTC 65X WG3
Basis: EN IEC 62443 series (with A11:2026 amendments)
CEN
10 standardsTC 224 WG17 / TC 47X WG02-03
Basis: EN ISO/IEC 15408 (Common Criteria)
How Standards Affect Your Conformity Route
The availability of harmonised standards directly impacts which conformity assessment route is available to you — especially for Important Class I products.
| Product Category | Assessment Route | With Harmonised Standards | Without Harmonised Standards |
|---|---|---|---|
| Default (~90% of products) | Self-assessment (Module A) | Self-assessment with reference to harmonised standards simplifies documentation | Self-assessment with own technical substantiation |
| Important Class I (Annex III Part I) | Module A or Module B+C | Self-assessment (Module A) permitted when harmonised standards are fully applied | Third-party assessment (Module B+C) or EU cybersecurity certification required |
| Important Class II (Annex III Part II) | Module B+C or Module H | Third-party assessment required — harmonised standards simplify the process | Third-party assessment or EU cybersecurity certification required |
| Critical (Annex IV) | Module B+C, Module H, or EU certification | EU cybersecurity certification may be required via delegated act | EU cybersecurity certification required if delegated act in force |
For Important Class I products, the availability of a harmonised standard makes the difference between self-assessment and mandatory third-party assessment. This is why the timely publication of Type C standards is critical.
The requested standards, one by one
M/606 - Commission standardisation request to CEN, CENELEC and ETSI (~41 standards), accepted on 2025-04-03. No CRA harmonised standard is cited in the EU Official Journal yet, so the Article 27 presumption of conformity is not available for any product category. Until then these standards structure and evidence conformity but grant no presumption. Track EUR-Lex / the OJ for the current state.
Horizontal (all products)
| Standard | Title | Status | M/606 line | Deadline for adoption | In Crosswalk |
|---|---|---|---|---|---|
| EN 40000-1-1 | Vocabulary and terminology | Enquiry closed | - | 2026-08-30 | Not yet |
| EN 40000-1-2 | Principles for cyber resilience | Enquiry closed | 1 | 2026-08-30 | Via IEC 62443-4-1 |
| EN 40000-1-3 | Vulnerability handling | Enquiry closed | 15 | 2026-08-30 | Via ISO/IEC 29147, ISO/IEC 30111 |
| EN 40000-1-4 | Generic security requirements (Annex I Part I) | In development | 2-14 | 2027-10-30 | Via IEC 62443-4-2, ETSI EN 303 645 |
Important · Class I
| Standard | Title | Status | M/606 line | Deadline for adoption | In Crosswalk |
|---|---|---|---|---|---|
| EN 304 617 | Embedded and standalone browsers | Mature draft | 17a/b | 2026-10-30 | Not yet |
| EN 304 618 | Password managers | In development | 18 | 2026-10-30 | Not yet |
| EN 304 619 | Antivirus / antimalware | Mature draft | 19 | 2026-10-30 | Not yet |
| EN 304 620 | Virtual private networks (VPN) | Mature draft | 20a | 2026-10-30 | Not yet |
| prEN 50770-4 | OT VPN | In development | 20b | 2026-10-30 | Via IEC 62443-4-2 |
| EN 304 621 | Network management systems | Mature draft | 21a | 2026-10-30 | Not yet |
| prEN 50770-2 | OT network management systems | In development | 21b | 2026-10-30 | Via IEC 62443-4-2 |
| EN 304 622 | SIEM | In development | 22a | 2026-10-30 | Not yet |
| prEN 50770-6 | OT SIEM | In development | 22b | 2026-10-30 | Via IEC 62443-4-2 |
| EN 304 623 | Boot managers | Mature draft | 23 | 2026-10-30 | Not yet |
| EN 304 624 | PKI / certificate issuance software | In development | 24 | 2026-10-30 | Not yet |
| EN 304 625 | Physical and virtual network interfaces | Mature draft | 25a | 2026-10-30 | Not yet |
| prEN 50770-3 | OT physical and virtual network interfaces | In development | 25b | 2026-10-30 | Via IEC 62443-4-2 |
| EN 304 626 | Operating systems | Mature draft | 26 | 2026-10-30 | Not yet |
| EN 304 627 | Routers, modems, switches | Final draft | 27a | 2026-10-30 | Via IEC 62443-4-2, ETSI EN 303 645 |
| prEN 50770-5 | OT routers, modems, switches | In development | 27b | 2026-10-30 | Via IEC 62443-4-2 |
| EN 50765 | Microprocessors / microcontrollers with security functions | Enquiry closed | 28-29 | 2026-10-30 | Not yet |
| EN 50767 | ASICs and FPGAs with security functions | In development | 30 | 2026-10-30 | Not yet |
| EN 304 631 | Smart-home virtual assistants | Mature draft | 31 | 2026-10-30 | Via ETSI EN 303 645 |
| EN 304 632 | Smart-home security products (e.g. cameras) | Mature draft | 32 | 2026-10-30 | Via ETSI EN 303 645 |
| EN 304 633 | Internet-connected toys | Mature draft | 33 | 2026-10-30 | Via ETSI EN 303 645 |
| EN 304 634 | Personal wearables | Mature draft | 34 | 2026-10-30 | Via ETSI EN 303 645 |
| (ref t.b.a.) | Identity / privileged-access management, authentication readers | In development | 16 | 2026-10-30 | Not yet |
Important · Class II
| Standard | Title | Status | M/606 line | Deadline for adoption | In Crosswalk |
|---|---|---|---|---|---|
| EN 304 635 | Hypervisors and container runtimes | Mature draft | 35 | 2026-10-30 | Not yet |
| EN 304 636 | Firewalls / IDS / IPS | Mature draft | 36a | 2026-10-30 | Via IEC 62443-4-2, IEC 62443-3-3 |
| prEN 50770-1 | OT firewalls / IDS / IPS | In development | 36b | 2026-10-30 | Via IEC 62443-4-2, IEC 62443-3-3 |
| EN 50766 | Tamper-resistant microprocessors / microcontrollers | Enquiry closed | 37-38 | 2026-10-30 | Not yet |
Critical
| Standard | Title | Status | M/606 line | Deadline for adoption | In Crosswalk |
|---|---|---|---|---|---|
| (ref t.b.a.) | Hardware devices with security boxes | In development | 39 | 2026-10-30 | Not yet |
| (ref t.b.a.) | Smart-meter gateways | In development | 40 | 2026-10-30 | Not yet |
| EN 50764 | Smartcard / secure-element platforms | Enquiry closed | 41a | 2026-10-30 | Not yet |
| EN 18330 | Smartcards / secure elements - application layer | Enquiry closed | 41b | 2026-10-30 | Not yet |
Supported today (interim route)
| Standard | Title | Status | M/606 line | Deadline for adoption | In Crosswalk |
|---|---|---|---|---|---|
| IEC 62443-4-1 | Secure product development lifecycle (Annex I Part I §1) | Published | - | - | Assessed today |
| IEC 62443-4-2 | Component technical security requirements (Annex I Part I §2) | Published | - | - | Assessed today |
| IEC 62443-3-3 | System security requirements & security levels | Published | - | - | Assessed today |
| ETSI EN 303 645 | Consumer IoT security baseline | Published | - | - | Assessed today |
| EN ISO/IEC 27001 | Information security management (ISMS - Annex I Part II) | Published | - | - | Assessed today |
| EN ISO/IEC 29147 | Vulnerability disclosure (Annex I Part II §5) | Published | - | - | Assessed today |
| EN ISO/IEC 30111 | Vulnerability handling processes (Annex I Part II §5) | Published | - | - | Assessed today |
Deadlines for adoption: the CEN, CENELEC and ETSI work programme for M/606 (V1, 2 April 2025). Statuses: state of play 2026-07, as bundled in Crosswalk; verify against the EU Official Journal and the standardisation organisations' work programmes before relying on any of them. "In Crosswalk" says whether Crosswalk assesses that ground today, directly or through a mapped published standard.
Current Status (April 2026)
No harmonised standards officially published in the EU Official Journal for the CRA
Multiple draft standards in 'mature draft' phase (browsers, password managers, antivirus, VPNs, SIEM, boot managers)
CENELEC developing A11:2026 amendments for EN IEC 62443-4-1 and -4-2
First harmonised standards expected Q3 2026; formal citation in Official Journal possibly Q2 2027
European Commission can establish common specifications via implementing acts if standards are delayed
Key Deadlines for Standards
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- Implementing Decision C(2025)618 — Standardisation Request M/606
- Implementing Regulation (EU) 2025/2392 — Technical descriptions product categories
- CEN-CENELEC standardisation programme
Crosswalk · From the team behind this siteReading is one thing. Crosswalk turns the CRA into an assessment.
Crosswalk walks you through Annex I Part I and Part II, the Art. 13 and Art. 14 duties, the Annex II information to the user and the Annex VII technical documentation, per product and for the organisation. Each requirement comes with the article text next to it, the questions an auditor asks, and a place for your evidence.
- Gap analysis against the CRA articles, with what is still open in priority order
- Annex VII technical documentation compiled from your own answers
- Security testing and secure code review checklists, mapped to Annex I Part II(3)
Lite licence at €0 at launch: one project, all five laws, no payment details, a small "Made with Crosswalk Lite" credit on what it makes. Paid plans from €99 per person per month.