A harmonised standard translates CRA legal requirements into more detailed technical specifications. Use is generally voluntary. Presumption of conformity arises only to the extent that:
- the product or process complies with the applicable harmonised standard or part; and
- the reference to that standard has been published in the Official Journal of the European Union for the CRA.
A draft, public enquiry, national standard or useful international standard does not by itself create Article 27 presumption of conformity. It may still be technical evidence, but the manufacturer must explain how it covers specific CRA requirements and address remaining gaps.
What to monitor
The Commission adopted standardisation request M/606 for 41 horizontal and product-specific standards. Horizontal standards address cross-cutting requirements and processes such as vulnerability handling. Vertical standards focus on specific important and critical product categories.
Monitor status in this order:
- Official Journal/EUR-Lex — decisive for presumption of conformity;
- Commission CRA standardisation page — mandate and implementation overview;
- STAN4CR — working status of standardisation deliverables;
- CEN-CENELEC and ETSI TC CYBER — standards development and approval.
On 13 August 2026, ETSI announced public enquiry on 17 draft product-specific EN 304 xxx standards. They are intended to become harmonised standards, but public enquiry alone does not create presumption of conformity.
Practical workflow
- maintain an Annex I requirements-to-evidence matrix;
- record each standard’s edition, date and legal status;
- identify requirements fully, partly or not covered by the standard;
- use internal specifications, analysis and testing for gaps;
- for Class I, determine specifically whether Article 32(2) permits module A; and
- monitor new and amended citations until placing on the market and account for them in series production and product changes.