Harmonised standards are the technical specifications that turn the Cyber Resilience Act's broad Annex I requirements into concrete, testable provisions. This page explains what they are and tracks every draft under the European Commission's standardisation request M/606: the product category, the body drafting it, its current status, and a link to each public draft.
Summary
- No CRA harmonised standard is published in the Official Journal yet (as of 2 October 2026), so the standards-based presumption of conformity under Article 27(1) is not yet available.
- The first two CRA standards passed the CEN-CENELEC formal vote. EN 40000-1-1 (vocabulary) and EN 40000-1-2 (principles, product risk management and lifecycle activities) are approved, and their ratification as ENs is scheduled for 2 November 2026. CEN-CENELEC records "no citation expected" in the Official Journal for both. So neither gives a presumption of conformity, and neither opens the standards-based self-assessment route for Class I products on its own.
- All 17 ETSI product drafts are in ETSI's approval procedure. Every EN 304 6xx enquiry draft is free to read. ETSI's 13 August announcement gave procedure end dates between mid-September and mid-November 2026, depending on the draft. Your national standardisation body sets the commenting deadline. EN 40000-1-3 (vulnerability handling), prEN 40000-10 (identity and access), prEN 40000-11 (hardware security boxes), the chip standards prEN 40001-3, 40002-3 and 40003-3, and prEN 18330 are under approval at CEN or CENELEC.
- The rest is earlier: the EN 50770 OT profiles and the EN 40000-1-4 generic security requirements are still in drafting. prEN 40004-3 (ASICs and FPGAs) entered its CENELEC enquiry on 25 September 2026, and the smart meter gateway standard has no number yet.
- You do not need to wait. Read the matching draft to anticipate the requirements and build the Annex I evidence the CRA requires regardless of which standard applies.
What a harmonised standard is
The Cyber Resilience Act sets out its essential cybersecurity requirements in broad legal terms. A harmonised standard is a technical specification, drafted by a European standardisation organisation at the European Commission's request, that turns those requirements into concrete, testable provisions.
A harmonised standard takes legal effect only once the Commission publishes its reference in the Official Journal of the European Union (OJEU). From that point, a product that conforms to the standard is presumed to meet the requirements that standard covers. In practice that does two things:
- it gives manufacturers a recognised, auditable way to demonstrate compliance; and
- for important products in Class I, applying a published harmonised standard lets the manufacturer self-assess by internal control instead of engaging a notified body. It does not remove the third-party assessment that Class II and critical products need, and ordinary products outside those tiers can already self-assess on their own.
Harmonised standards are one of three routes to that presumption. A certificate under a European cybersecurity certification scheme is another, under Article 27(8), though no scheme is yet recognised for the CRA.
Status, as of 2 October 2026: no CRA harmonised standard has its reference published in the Official Journal. EN 40000-1-1 and EN 40000-1-2 passed the CEN-CENELEC formal vote, and their ratification as ENs is scheduled for 2 November 2026. CEN-CENELEC does not expect either of them to be cited in the Official Journal. The 17 product-specific ETSI drafts are in ETSI's approval procedure, and every other standard in the tables below is still a draft. So the standards-based presumption of conformity under Article 27(1) is not yet available. Approval, ratification as an EN and the Official Journal citation are separate milestones, and only the citation gives the presumption. Use the drafts to anticipate the requirements, not as a finished basis for conformity.
Horizontal and vertical standards
The Commission takes a two-fold approach, so each draft standard is one of two kinds:
- Horizontal standards set a common framework, methodology and taxonomy, and apply to every product with digital elements.
- Vertical standards (also called product-specific) cover the specific risks of one product type, for example routers, or antivirus software.
The three standard types and their deadlines
Standardisation request M/606 sorts the work into three types. The deadlines in the table are delivery deadlines: the date each standardisation organisation must hand its standard to the Commission. They are not publication dates. A standard gives the Article 27 presumption of conformity only once its reference appears in the Official Journal, which follows delivery on a timetable the Commission has not yet set.
| Type | Group | Standard | Topic | Delivery deadline |
|---|---|---|---|---|
| A | Framework | EN 40000-1-2 | Principles, product risk management, and lifecycle activities | 30 August 2026 |
| B | Product-agnostic | EN 40000-1-4 EN 40000-1-3 | Generic security requirements Vulnerability handling | 30 October 2027 30 August 2026 |
| C | Product-specific | EN 304 6xx, EN 50770, EN 40000-10, EN 40000-11, EN 40001-3 to EN 40004-3, EN 18330 | One per product category (ETSI verticals plus the CEN and CENELEC operational-technology, identity, chip and secure-element work) | 30 October 2026 |
A few things the table does not spell out:
- Type A, framework: the overarching Annex I principle is "Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks." CEN-CENELEC records no Official Journal citation expected for EN 40000-1-2. It sets the framework and the risk management method without giving a presumption of conformity.
- Type B, vulnerability handling: builds on existing ISO/IEC work and covers the full process, from discovery and triage to remediation.
- Type C, product-specific: must stay consistent with Type A and Type B, and applies to both important and critical product categories.
Type A and Type B are the horizontal EN 40000-1 parts. Type C is every product standard in the per-tier tables below, including the CEN product standards EN 40000-10 and EN 40000-11.
How the standards are being developed
The Commission asked CEN, CENELEC and ETSI to draft these standards through standardisation request M/606, issued by Commission Implementing Decision C(2025) 618 final (3 February 2025):
- ETSI (Technical Committee CYBER, CYBER-EUSR) is drafting the standards for most important software and connected-product categories. These carry EN 304 6xx references and are the furthest along; their drafts are public in the ETSI CYBER-EUSR open consultation folder, with project history in the ETSI Labs STAN4CRA repositories, and are linked individually below.
- CEN and CENELEC are drafting the horizontal standards (the EN 40000-1 parts), the operational-technology profiles (EN 50770 series), the chip and secure-element platform standards (EN 40001-3 to EN 40004-3), and the identity, security-box and smartcard work in CEN/TC 224 (EN 40000-10, EN 40000-11 and EN 18330). These have no single public folder; status is tracked through the DIN/DKE CRA standardisation projects matrix, the CEN/CENELEC standards search, and STAN4CRA technical work.
A draft moves through working-group versions and a public CEN Enquiry (for ETSI, an open consultation and approval vote), then ratification as an EN. CEN-CENELEC may skip a separate formal vote and publish directly after a positive Enquiry. Ratification is still not the finish line: the Commission must then cite the reference in the Official Journal, and only that citation triggers the presumption of conformity. As of 2 October 2026, EN 40000-1-1 and EN 40000-1-2 have passed the formal vote, and their ratification is scheduled for 2 November 2026. The 17 ETSI product-specific drafts are in ETSI's approval procedure. None of the standards on this page is ratified or cited in the Official Journal yet. The Commission has not confirmed an Official Journal citation timetable.
How to read the status
| Status | Meaning |
|---|---|
| In development | Work item active; no public draft confirmed in our sources. |
| ETSI approval | The ETSI draft is in ETSI's approval procedure, which opened with a public enquiry in summer 2026. The enquiry draft is free to read (linked in the table). ETSI's 13 August 2026 announcement gave procedure end dates between mid-September and mid-November, depending on the draft. Check your national standardisation body for the commenting deadline, and the ETSI work programme for the current step. It is not approved. |
| In enquiry | A CEN or CENELEC draft is out for public enquiry. Comment through your national standardisation body. The text is not free. |
| Enquiry closed | The draft has been through its public CEN enquiry (a comment-and-vote round) and is being finalised for approval. The text is not free: a draft copy can usually be bought from a national standards body such as DIN, but there is no free public PDF, which is why these rows show "n/a" for the draft. |
| Approved in formal vote | CEN-CENELEC members approved the final draft in the formal vote. It becomes an EN when the CEN-CENELEC Technical Board ratifies it. Until then it is not an EN, and it is not cited in the Official Journal. |
| Approved (EN ratified) | Adopted as an EN by CEN-CENELEC or ETSI, but not yet cited in the Official Journal, so no presumption of conformity yet. |
| Published in OJEU | Reference in the Official Journal; presumption of conformity applies. |
The tables below are grouped by CRA conformity tier. Horizontal standards apply to every product; the vertical (product-specific) standards are split into Important Class I, Important Class II, and Critical, because the tier decides the conformity route. The standard reference shows who drafts it:
- EN 304 6xx: ETSI.
- EN 40000-1-x: CEN-CLC/JTC 13.
- EN 40000-10, EN 40000-11 and EN 18330: CEN/TC 224.
- EN 50770: CLC/TC 65X operational-technology profiles that run alongside the ETSI standards for the same functions.
- EN 40001-3 to EN 40004-3: CLC/TC 47X. They replace the earlier project references EN 50765, EN 50766, EN 50764 and EN 50767, in that order.
No standard has reached "Approved (EN ratified)" or "Published in OJEU" yet. EN 40000-1-1 and EN 40000-1-2 are at "Approved in formal vote", with ratification scheduled for 2 November 2026. Status reflects the most recent public evidence on the date shown at the top of this page.
Horizontal standards: the EN 40000 series
The EN 40000-1 parts, drafted by CEN-CLC/JTC 13, apply to every product with digital elements, on top of any vertical (product-specific) standard in the sections below. EN 40000-10 and EN 40000-11 are CEN/TC 224 product standards and sit in the tier tables.
| M/606 | Standard | Topic | Status |
|---|---|---|---|
| n/a | EN 40000-1-1 | Vocabulary | Approved in formal vote. Ratification scheduled for 2 November 2026. No Official Journal citation expected. |
| 1 | EN 40000-1-2 | Principles, product risk management, and lifecycle activities | Approved in formal vote. Ratification scheduled for 2 November 2026. No Official Journal citation expected. |
| 15 | EN 40000-1-3 | Vulnerability handling | Enquiry closed |
| 2-14 | EN 40000-1-4 | Generic security requirements | In development |
CEN-CENELEC's database records "No citation expected for Directive 2024/2847" for EN 40000-1-1 and EN 40000-1-2. A standard gives a presumption of conformity only once its reference is cited in the Official Journal. So these two parts fix the shared vocabulary and the risk management method, but they do not open a conformity route on their own. EN 40000-1-3 is listed with a citation expected.
Important products: Class I
These cover the Annex III Class I categories. Applying a published harmonised standard lets a Class I manufacturer self-assess by internal control; without one, conformity has to be shown another way.
| M/606 | Standard | Product category | Status | Latest public draft |
|---|---|---|---|---|
| 16 | prEN 40000-10 | Identity management, privileged access management, authentication and access control readers | Enquiry closed | n/a |
| 17a/b | EN 304 617 | Embedded and standalone browsers | ETSI approval | V1.0.0 · Aug 2026 |
| 18 | EN 304 618 | Password managers | ETSI approval | V0.2.2 · Jun 2026 |
| 19 | EN 304 619 | Antivirus / antimalware | ETSI approval | V1.0.0 · Jul 2026 |
| 20a | EN 304 620 | Virtual private networks (VPN) | ETSI approval | V1.0.0 · Aug 2026 |
| 20b | prEN 50770-4 | OT VPN | In development | n/a |
| 21a | EN 304 621 | Network management systems | ETSI approval | V1.0.5 · Aug 2026 |
| 21b | prEN 50770-2 | OT network management systems | In development | n/a |
| 22a | EN 304 622 | SIEM | ETSI approval | V1.0.0 · Aug 2026 |
| 22b | prEN 50770-6 | OT SIEM | In development | n/a |
| 23 | EN 304 623 | Boot managers | ETSI approval | V0.1.3 · Jun 2026 |
| 24 | EN 304 624 | PKI / certificate issuance software | ETSI approval | V1.0.0 · Aug 2026 |
| 25a | EN 304 625 | Physical and virtual network interfaces | ETSI approval | V1.0.0 · Aug 2026 |
| 25b | prEN 50770-3 | OT physical and virtual network interfaces | In development | n/a |
| 26 | EN 304 626 | Operating systems | ETSI approval | V1.0.1 · Aug 2026 |
| 27a | EN 304 627 | Routers, modems, switches | ETSI approval | V1.0.1 · Jul 2026 |
| 27b | prEN 50770-5 | OT routers, modems, switches | In development | n/a |
| 28-29 | prEN 40001-3 | Microprocessors and microcontrollers with security functions | Enquiry closed | n/a |
| 30 | prEN 40004-3 | ASICs and FPGAs with security functions | In enquiry | n/a |
| 31 | EN 304 631 | Smart home virtual assistants | ETSI approval | V1.0.0 · Jul 2026 |
| 32 | EN 304 632 | Smart home products with security functionalities (e.g. security cameras) | ETSI approval | V1.0.0 · Jul 2026 |
| 33 | EN 304 633 | Internet-connected toys | ETSI approval | V1.0.0 · Jul 2026 |
| 34 | EN 304 634 | Personal wearables | ETSI approval | V1.0.0 · Jul 2026 |
Important products: Class II
Class II products always need third-party (notified-body) assessment; a harmonised standard does not unlock self-assessment for them.
| M/606 | Standard | Product category | Status | Latest public draft |
|---|---|---|---|---|
| 35 | EN 304 635 | Hypervisors and container runtime systems | ETSI approval | V1.0.1 · Jun 2026 |
| 36a | EN 304 636 | Firewalls / IDS / IPS | ETSI approval | V1.0.0 · Jul 2026 |
| 36b | prEN 50770-1 | OT firewalls / IDS / IPS | In development | n/a |
| 37-38 | prEN 40002-3 | Tamper-resistant microprocessors and microcontrollers | Enquiry closed | n/a |
Critical products
Critical products (Annex IV) must use a European cybersecurity certification scheme where one is mandated, or otherwise the same third-party routes as Class II. A harmonised standard does not remove that requirement. Entries 39, 40 and 41 are developed in a restricted setting because they cover sensitive critical products. That is why their drafts are not public.
| M/606 | Standard | Product category | Status |
|---|---|---|---|
| 39 | prEN 40000-11 | Hardware devices with security boxes | Enquiry closed |
| 40 | Reference not yet assigned | Smart meter gateways (CEN-CLC/JTC 13 WG 6) | In development |
| 41a | prEN 40003-3 | Platforms of smartcards and secure elements | Enquiry closed |
| 41b | EN 18330 / prEN 18330 | Smartcards and secure elements, application layer | Enquiry closed |
Frequently asked questions
Are any CRA harmonised standards in force yet?
No. As of 2 October 2026 no CRA harmonised standard has its reference published in the Official Journal, so the standards-based presumption of conformity under Article 27(1) is not yet available. The first two CEN-CENELEC standards, EN 40000-1-1 (vocabulary) and EN 40000-1-2 (principles, product risk management and lifecycle activities), passed the formal vote. Their ratification as ENs is scheduled for 2 November 2026, and CEN-CENELEC does not expect either to be cited in the Official Journal. All 17 of ETSI's EN 304 6xx product drafts are in ETSI's approval procedure. The Official Journal citation is a separate step after approval, on a date the Commission has not confirmed.
Do EN 40000-1-1 and EN 40000-1-2 give a presumption of conformity?
No. CEN-CENELEC's database records "No citation expected for Directive 2024/2847" for EN 40000-1-1 and EN 40000-1-2. Under Article 27(1), the presumption applies only to harmonised standards whose references are published in the Official Journal. So applying these two parts does not by itself show conformity, and it does not open the standards-based self-assessment route for an Important Class I product. They are still worth reading. EN 40000-1-1 fixes the terms the other parts use. EN 40000-1-2 sets out general cybersecurity principles and risk management activities for every stage of the product lifecycle, which is useful input for your risk assessment. The parts that CEN-CENELEC lists with a citation expected include EN 40000-1-3 (vulnerability handling), prEN 40000-10 and prEN 18330.
Do I have to wait for a harmonised standard to comply with the CRA?
No. A harmonised standard is one route to demonstrate conformity, not the only one. CRA obligations apply on the regulation's own timeline whether or not a standard exists. You can meet the Annex I essential requirements directly and record how in your technical documentation. A published standard simply gives a recognised, auditable way to show conformity with the requirements it covers, and for important Class I products it opens the internal-control self-assessment route.
What does "presumption of conformity" actually give me?
Under Article 27, a product that conforms to a harmonised standard whose reference is published in the Official Journal is presumed to meet the Annex I requirements that standard covers. In practice it gives you a defensible, recognised basis for your conformity claim, and for important Class I products it lets you self-assess by internal control instead of engaging a notified body. It does not change the third-party assessment that Class II and critical products require under Article 32.
Where can I read the draft standards?
It depends on who is drafting it. The ETSI EN 304 6xx drafts are published for free in the ETSI CYBER-EUSR open consultation folder, linked per standard in the tables above. The CEN/CENELEC drafts (the EN 40000 parts, EN 50770, EN 40001-3 to EN 40004-3 and EN 18330) are different: there is no free public folder. You can see that a draft exists and buy a copy from a national standards body (DIN, NEN, AFNOR, BSI, and so on), but the text is not published for free, and once a draft's public enquiry closes even the free comment access ends. That is why those rows show "n/a" for the latest public draft.
Can I rely on a draft that is in public enquiry?
Use it to anticipate the requirements, not as a finished legal basis. A draft in public enquiry is being commented on precisely so that it can change, and it can change again during the rest of the approval process or the Commission's assessment. The presumption of conformity does not apply until the reference appears in the Official Journal. Reading it now is still the fastest way to prepare.
Can I comment on the draft standards?
Yes, while your national standardisation body still accepts comments on the draft. ETSI's 13 August 2026 announcement gave procedure end dates between mid-September and mid-November 2026, depending on the draft. It did not publish one commenting deadline per draft. Send comments through your national standardisation body, DIN, AFNOR, UNE, NEN, SIS and the rest, which sets its own deadline weeks before ETSI's. ETSI takes comments directly too, but says comments sent that way since 16 April 2026 may only reach a future revision unless you also submit them through your national body.
What is the difference between the EN 304 6xx and EN 40000 standards?
The EN 304 6xx standards, drafted by ETSI, are product-specific: each targets one category such as browsers, operating systems, or routers. The EN 40000-1 parts, drafted by CEN-CLC/JTC 13, are horizontal: they set principles, generic security requirements, and vulnerability-handling rules that apply across categories. CEN/TC 224 also uses the EN 40000 number for two product standards, EN 40000-10 for identity and access products and EN 40000-11 for hardware devices with security boxes. A single product may need to read both a horizontal standard and the one for its category.
Do any of these standards cover critical products, not just important ones?
Yes. Most of the tracked standards cover important products, but a few cover critical ones: the secure-element platform standard (prEN 40003-3), the hardware devices with security boxes standard (prEN 40000-11), plus the work on smart meter gateways and smartcards. Critical products must use a European cybersecurity certification scheme where one is mandated, or otherwise the same third-party assessment routes as Class II products. The Critical products section above lists them separately. A harmonised standard does not let a critical product skip that assessment the way it can for an important Class I product.
When will the standards be published in the Official Journal?
There is no confirmed citation date for any CRA harmonised standard. EN 40000-1-1 and EN 40000-1-2 are scheduled for ratification on 2 November 2026, but CEN-CENELEC does not expect them to be cited at all. The ETSI EN 304 6xx drafts are in ETSI's approval procedure. ETSI's 13 August 2026 announcement gave procedure end dates between mid-September and mid-November 2026, depending on the draft. Approval and the Commission's assessment come before a reference can be cited. Treat the status column here as the current state and check the standards bodies' trackers linked above for movement.
Does the CRA also affect the Radio Equipment Directive's cybersecurity delegated act and EN 18031?
Yes, for certain radio equipment. Commission Delegated Regulation (EU) 2022/30 applies essential requirements from Article 3(3), points (d), (e) and (f), of Directive 2014/53/EU (the Radio Equipment Directive) to that equipment. The harmonised standards EN 18031-1, EN 18031-2 and EN 18031-3 are cited in the Official Journal in support of those requirements; manufacturers may use them, like any harmonised standard under EU product law, to get a presumption of conformity with the delegated act. That is a voluntary means, not an obligation manufacturers must keep meeting on its own. Per question 18 of the European Commission's FAQ on the Cyber Resilience Act (v1.4), the Commission aims to repeal Delegated Regulation (EU) 2022/30 as of 11 December 2027, the date the CRA generally starts to apply. In that case, radio equipment placed on the market between 1 August 2025 and 10 December 2027 stays subject to the RED Delegated Regulation's cybersecurity requirements, while equipment placed on the market from 11 December 2027 becomes subject to the CRA's essential requirements instead. CRA Article 71(2) sets that same date: "This Regulation shall apply from 11 December 2027." Recital 30 explains why the dates line up for that equipment: this Regulation's essential cybersecurity requirements already include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f), of Directive 2014/53/EU. No repeal of Delegated Regulation (EU) 2022/30 has been confirmed as adopted; check the European Commission's CRA FAQ page for the current position.