Important Legal Notice: This website does not replace official EU publications
We are not responsible for discrepancies with official sources. Always consult the official publications referenced in our resources section for legal compliance and authoritative information.
Standards
MRThe Regulation does not mandate standards. Harmonised standards and common specifications give a presumption of conformity with the Annex III requirements they cover (Art. 20); the requirements themselves are the law.
Article 20
Each one covers only the requirements the standard, specification or certificate addresses. The rest of Annex III still has to be shown in the technical documentation.
Art. 20(1) and (2)
A product in conformity with harmonised standards, or parts of them, whose references are published in the Official Journal is presumed to conform to the Annex III requirements those standards cover. The Commission requests the European standardisation organisations to draft them.
Art. 20(3)
Where harmonised standards are missing or insufficient, the Commission may adopt implementing acts with common specifications; conformity with them gives the same presumption for the requirements they cover.
Art. 20(9)
Machinery certified, or with a statement of conformity, under a cybersecurity certification scheme adopted under Regulation (EU) 2019/881, once the scheme references are published, is presumed to conform to Annex III sections 1.1.9 and 1.2.1 insofar as the certificate covers them.
Which standards are harmonised under the Regulation follows from the references the Commission publishes in the Official Journal. This site does not keep that list.
What Crosswalk uses
For Annex III sections 1.1.9 and 1.2.1, Crosswalk maps its controls to two documents from the machinery-safety world. They help structure the work; they do not carry presumption of conformity.
ISO/TR 22100-4
Guidance to machinery manufacturers for consideration of related IT-security (cyber security) aspects
A technical report: guidance on how IT security relates to the ISO 12100 risk assessment. Not a harmonised standard.
IEC TS 63074
Technical specification
How security threats and vulnerabilities bear on safety-related control systems. Not a harmonised standard.
Crosswalk assesses against the articles and shows which standards you already use serve which requirement.
EU cybersecurity laws can be complex. Our free tools and guides work great for most people, but if you're dealing with something particularly challenging or have tight deadlines, we're here to help.
