The Cyber Resilience Act (CRA) tells manufacturers what their products must achieve. It doesn’t tell them how. That’s the job of harmonised standards: once a standard is cited in the Official Journal of the EU, a product that meets it is presumed to conform with the CRA requirements the standard covers.
The European Commission asked the European standardization organizations for these standards in standardization request M/606. The work is split across CEN, CENELEC and ETSI, and progress differs a lot between committees. The tables below show where each standard stood in October 2026.
Why the timing matters
The CRA’s reporting obligations for actively exploited vulnerabilities and severe incidents have applied since 11 September 2026. The essential requirements for products apply from 11 December 2027. Which standards reach the Official Journal before that date decides how much work your conformity assessment takes.
The route depends on the product class:
- Default products (not listed in Annex III or IV) can use internal control (module A), with or without harmonised standards.
- Important products of class I (Annex III) can use internal control only if you apply harmonised standards, common specifications or a European cybersecurity certification scheme. Without one of these, you need a notified body.
- Important products of class II (Annex III) always need a third-party assessment.
- Critical products (Annex IV) follow the class II procedures until the Commission requires a European cybersecurity certificate, such as EUCC, by delegated act.
For a class I product, a missing harmonised standard is the difference between internal control and paying a notified body to do the assessment.
How to read the tables
Horizontal standards apply to every product with digital elements. Vertical standards add requirements for one product category from Annex III or IV. The M/606 column gives the item number in the standardization request. Some items are covered by two committees and carry an “a” and a “b”: #36a (firewalls) is written by ETSI, #36b (industrial firewalls) by CLC/TC 65X.
Each standard moves through the same stages:
- NWI
- prEN draft
- prEN vote
- EN draft
- EN vote (FV)
- Adopted
- HAS assessment
- OJ citation
A new work item (NWI) is approved, the committee writes a draft (prEN), and national bodies comment on it in the enquiry vote. The committee then prepares the final text (EN draft) for the formal vote (FV). After adoption, a Harmonised Standards (HAS) consultant checks the standard against the request. Only citation in the Official Journal (OJ) gives presumption of conformity.
Horizontal standards: CEN/CLC JTC 13 WG9
These apply to all products. EN 40000-1-2 (principles and risk management) is adopted and EN 40000-1-3 (vulnerability handling) is at formal vote. EN 40000-1-4 covers M/606 items #2 to #14, the bulk of the product requirements in Annex I part I, and it’s still at the draft stage. That’s the one most manufacturers are waiting for.
| Standard | M/606 | Scope | Class | Stage |
|---|---|---|---|---|
| EN 40000-1-2 | #1 | Principles, risk management, lifecycle | Horizontal | Adopted |
| EN 40000-1-3 | #15 | Vulnerability handling | Horizontal | FV pending |
| EN 40000-1-4 | #2–14 | Generic security requirements | Horizontal | prEN draft |
| EN 40000-1-1 | – | Vocabulary | Not in M/606 | Adopted |
| TR (no. tbc) | – | Proof of concept: EN 18037 for the CRA | Not in M/606 | prEN draft |
| TS (no. tbc) | – | Guidance: applying EN 18037 for the CRA | Not in M/606 | prEN draft |
Vertical standards: ETSI TC CYBER
ETSI writes 17 of the product-specific standards in the EN 304 6xx series, most of them for class I products. Ten of those have passed the enquiry vote and are at EN draft. Two cover class II products: hypervisors and container runtimes (EN 304 635) and firewalls, intrusion detection and prevention systems (EN 304 636). EN 304 642 for telecom network functions sits outside M/606.
| Standard | M/606 | Product category | Class | Stage |
|---|---|---|---|---|
| EN 304 617 | #17a+b | Browsers | Class I | prEN vote |
| EN 304 618 | #18 | Password managers | Class I | EN draft |
| EN 304 619 | #19 | Anti-malware software | Class I | EN draft |
| EN 304 620 | #20a | VPN products | Class I | prEN vote |
| EN 304 621 | #21a | Network management systems | Class I | prEN vote |
| EN 304 622 | #22a | SIEM systems | Class I | prEN vote |
| EN 304 623 | #23 | Boot managers | Class I | EN draft |
| EN 304 624 | #24 | PKI and digital certificate issuance software | Class I | prEN vote |
| EN 304 625 | #25a | Physical and virtual network interfaces | Class I | prEN vote |
| EN 304 626 | #26 | Operating systems | Class I | prEN vote |
| EN 304 627 | #27a | Routers, modems and switches | Class I | EN draft |
| EN 304 631 | #31 | Virtual assistants | Class I | EN draft |
| EN 304 632 | #32 | Smart home security products | Class I | EN draft |
| EN 304 633 | #33 | Connected toys | Class I | EN draft |
| EN 304 634 | #34 | Wearables | Class I | EN draft |
| EN 304 635 | #35 | Hypervisors and container runtimes | Class II | EN draft |
| EN 304 636 | #36a | Firewalls, intrusion detection and prevention systems | Class II | EN draft |
| EN 304 642 | – | Telecom network functions | Not in M/606 | prEN draft |
Semiconductors and trusted chips: CLC/TC 47X
Four standards cover microprocessors, microcontrollers and the secure hardware they become part of. Each carries two numbers: the EN 4000x-3 number in the CRA series and the prEN 5076x number it was developed under.
| Standard | M/606 | Product category | Class | Stage |
|---|---|---|---|---|
| EN 40001-3 / prEN 50765 | #28, #29 | Microprocessors and microcontrollers | Class I | EN draft |
| EN 40004-3 / prEN 50767 | #30 | FPGAs and ASICs | Class I | prEN vote |
| EN 40003-3 / prEN 50766 | #37, #38 | Tamper-resistant microprocessors and microcontrollers | Class II | EN draft |
| EN 40002-3 / prEN 50764 | #41a | Smartcard and secure element platforms | Critical | EN draft |
Personal identification devices: CEN/TC 224
| Standard | M/606 | Product category | Class | Stage |
|---|---|---|---|---|
| EN 40000-10 | #16 | Identity management and privileged access management | Class I | EN draft |
| EN 40000-11 | #39 | Hardware devices with security boxes | Critical | EN draft |
| EN 18330 | #41b | Smartcards and secure elements, application layer | Critical | EN draft |
Smart meter gateways: CEN/CLC JTC 13 WG6
| Standard | M/606 | Product category | Class | Stage |
|---|---|---|---|---|
| EN (no. tbc) | #40 | Smart meter gateways | Critical | prEN draft |
Industrial (OT) products: CLC/TC 65X
The EN 50770 series gives OT versions of several ETSI product categories, built on IEC 62443. All parts are at prEN draft. EN 50770-1 was split into two parts, one for firewalls and one for intrusion detection and prevention. Alongside, the committee is amending three IEC 62443 standards (the prAA documents) to line them up with the CRA. Those amendments aren’t M/606 items, but anyone already certified against IEC 62443 should watch them.
| Standard | M/606 | Product category | Class | Stage |
|---|---|---|---|---|
| EN 50770-1-1 | #36b | Industrial firewalls | Class II | prEN draft |
| EN 50770-1-2 | #36b | Industrial intrusion detection and prevention | Class II | prEN draft |
| EN 50770-2 | #21b | Network management | Class I | prEN draft |
| EN 50770-3 | #25b | Network interfaces | Class I | prEN draft |
| EN 50770-4 | #20b | VPN | Class I | prEN draft |
| EN 50770-5 | #27b | Routers and switches | Class I | prEN draft |
| EN 50770-6 | #22b | SIEM | Class I | prEN draft |
| EN IEC 62443-4-1/prAA | – | Secure product development lifecycle | Not in M/606 | EN draft |
| EN IEC 62443-4-2/prAA | – | Technical requirements for components | Not in M/606 | EN draft |
| EN IEC 62443-3-3/prAA | – | System requirements and security levels | Not in M/606 | NWI |
What to do with this
Find your product category in the tables. If its standard has passed the enquiry vote, get the draft through your national standards body and run a gap assessment against it now.
If your product is class I and its standard is still at an early stage, plan for both outcomes: internal control (module A) if the standard is cited in time, and a notified body if it isn’t. Notified body capacity for the CRA is still being built, so booking late is a risk in itself.
Whatever your class, EN 40000-1-2 and EN 40000-1-3 are worth adopting today. Risk management and vulnerability handling are where most CRA gaps show up, and both standards are close to final. The EU CRA Compliance Journey builds your risk assessment and vulnerability handling on these standards.
Not sure which class your product falls in? Run the free EU CRA Self Assessment or book a free EU CRA strategy call.
Sources: DIN/DKE CRA status list, October 2026; ETSI TC CYBER work programme, 16 October 2026. Stages change every month; this overview reflects the status on the date above.