Harmonized standards are how most manufacturers will show that a product meets the Cyber Resilience Act essential requirements. Once a standard is cited in the Official Journal of the EU, applying it gives a presumption of conformity with the requirements it covers (Article 27). For important products in Class I, a fully applied cited standard also opens the internal-control route (module A).
The Commission’s standardization request M/606 to CEN, CENELEC and ETSI lists 41 deliverables. Fewer standards answer them: EN 40000-1-4 covers lines 2 to 14 on its own, and a few product standards cover two lines each. The table also includes related work that is not a line in M/606, such as the EN 40000-1-1 vocabulary and the IEC 62443 amendments. Each row shows where the standard stands, grouped by the products it covers.
No CRA harmonized standard is cited in the Official Journal yet. Until one is, manufacturers assess against the essential requirements of Annex I directly. Most standards in the table are expected to be cited and will then give a presumption of conformity. The few tagged No OJ citation expected are not, even once they are approved and published.
Stage key
- Drafting 3 standards The committee is writing the draft. It has not reached public enquiry or a formal vote.
- Enquiry 6 standards The draft is out for public enquiry, where national standards bodies comment on it, or the comments are being resolved.
- Approval 21 standards The draft is in its final approval step. In CEN-CENELEC this is the formal vote; ETSI runs a combined enquiry and vote, followed by final approval.
- Approved 2 standards The standards body has approved the standard and it is published or awaiting publication. Until it is cited in the Official Journal, it gives no presumption of conformity.
- Cited in OJ 0 standards The reference is published in the Official Journal of the EU. Applying the standard gives a presumption of conformity with the requirements it covers.
Horizontal standards
Apply to all products with digital elements. Drafted by CEN-CENELEC JTC 13 WG 9.
| Standard | Covers | Stage |
|---|---|---|
| EN 40000-1-1 Not in M/606 No OJ citation expected | Vocabulary | Approved Ratified November 2, 2026; publication planned for November 2026. Supporting standard, not requested by M/606. |
| EN 40000-1-2 M/606 #1 No OJ citation expected | Principles, product risk management and lifecycle activities | Approved Ratified November 2, 2026; publication planned for November 2026. |
| prEN 40000-1-3 M/606 #15 | Vulnerability handling | Approval Submitted for formal vote. |
| prEN 40000-1-4 M/606 #2–14 No OJ citation expected | Generic security requirements (Annex I, Part I) | Drafting Draft completed; publication planned for June 2027. M/606 deadline October 30, 2027. |
Important products, Class I
Vertical standards for the Annex III Class I categories. With a cited harmonized standard fully applied, these products can use internal control (module A).
| Standard | Covers | Stage |
|---|---|---|
| prEN 40000-10 M/606 #16 | Identity management and privileged access management, including access control readers | Approval CEN/TC 224 WG 17. Formal vote was planned for October 31, 2026; no result published yet. |
| EN 304 617 M/606 #17 | Browsers | Approval Enquiry and vote closed November 5, 2026; comments being resolved. |
| EN 304 618 M/606 #18 | Password managers | Approval Final approval planned January 4, 2027. |
| EN 304 619 M/606 #19 | Software that searches for, removes or quarantines malicious software | Approval Final approval planned January 4, 2027. |
| EN 304 620 M/606 #20 | Virtual private networks (VPN) | Approval Enquiry and vote closed November 5, 2026; comments being resolved. |
| EN 304 621 M/606 #21 | Network management systems | Approval Enquiry and vote closed November 5, 2026; comments being resolved. |
| EN 304 622 M/606 #22 | Security information and event management (SIEM) systems | Approval Enquiry and vote closed November 5, 2026; comments being resolved. |
| EN 304 623 M/606 #23 | Boot managers | Approval Final approval planned January 11, 2027. |
| EN 304 624 M/606 #24 | Public key infrastructure and digital certificate issuance software | Approval Final approval planned February 11, 2027. |
| EN 304 625 M/606 #25 | Physical and virtual network interfaces | Approval Enquiry and vote closed November 2, 2026; comments being resolved. |
| EN 304 626 M/606 #26 | Operating systems | Approval Enquiry and vote closed November 5, 2026; comments being resolved. |
| EN 304 627 M/606 #27 | Routers, modems intended for connection to the internet, and switches | Approval Final approval planned January 4, 2027. |
| prEN 40001-3 M/606 #28–29 | Microprocessors and microcontrollers with security-related functionalities | Enquiry CLC/TC 47X. Still at the enquiry stage; the formal vote was planned for August 13, 2026. |
| prEN 40004-3 M/606 #30 | ASICs and FPGAs with security-related functionalities | Enquiry CLC/TC 47X. Enquiry closes December 18, 2026. |
| EN 304 631 M/606 #31 | Smart home general purpose virtual assistants | Approval Final approval planned January 18, 2027. |
| EN 304 632 M/606 #32 | Smart home products with security functionalities (door locks, cameras, baby monitors, alarms) | Approval Final approval planned January 18, 2027. |
| EN 304 633 M/606 #33 | Internet-connected toys with social interactive or location tracking features | Approval Final approval planned January 18, 2027. |
| EN 304 634 M/606 #34 | Personal wearables for health monitoring and children's wearables | Approval Final approval planned January 18, 2027. |
Important products, Class II
Vertical standards for the Annex III Class II categories. These products need third-party assessment (modules B+C or H) or a certification scheme.
| Standard | Covers | Stage |
|---|---|---|
| EN 304 635 M/606 #35 | Hypervisors and container runtime systems | Approval Final approval planned January 18, 2027. |
| EN 304 636 M/606 #36 | Firewalls, intrusion detection and prevention systems | Approval Final approval planned February 11, 2027. |
| prEN 40002-3 M/606 #37–38 | Tamper-resistant microprocessors and microcontrollers | Enquiry CLC/TC 47X. Still at the enquiry stage; the formal vote was planned for August 13, 2026. |
Critical products
Vertical standards for the Annex IV categories. Drafted by CEN and CENELEC only.
| Standard | Covers | Stage |
|---|---|---|
| prEN 40000-11 M/606 #39 | Hardware devices with security boxes | Approval CEN/TC 224 WG 17. Formal vote was planned for September 10, 2026; no result published yet. |
| prEN 40000-9 M/606 #40 | Smart meter gateways | Drafting CEN-CLC/JTC 13 WG 6. Formal vote planned December 21, 2026. |
| prEN 18330 M/606 #41 | Smartcards or similar devices, including secure elements (application layer) | Approval CEN/TC 224. Formal vote planned March 18, 2027. |
| prEN 40003-3 M/606 #41 | Platforms of smartcards and similar devices, including secure elements | Enquiry CLC/TC 47X. Still at the enquiry stage; the formal vote was planned for August 13, 2026. |
Industrial automation (OT)
CENELEC TC 65X profiles and amendments based on IEC 62443, for OT versions of the Class I and II categories.
| Standard | Covers | Stage |
|---|---|---|
| prEN 50770-1 to -6 M/606 #20–22, #25, #27, #36 | OT security profiles for firewalls and IDS/IPS, network management, network interfaces, VPN, routers and switches, and SIEM | Drafting Formal votes planned August 3, 2027. |
| EN IEC 62443-4-1/prAA Not in M/606 | Secure product development lifecycle, CRA amendment | Enquiry At the enquiry stage; formal vote planned February 23, 2027. |
| EN IEC 62443-4-2/prAA Not in M/606 | Technical security requirements for IACS components, CRA amendment | Enquiry At the enquiry stage; formal vote planned February 8, 2027. |
Recent changes
Checked on
- EN 40000-1-1 and EN 40000-1-2 were ratified on November 2, 2026, and are now Approved. Publication is planned for November 2026.
- prEN 40000-1-3 has been submitted for formal vote and is now in Approval.
- ETSI closed the enquiry and vote for EN 304 625 on November 2 and for EN 304 617, 620, 621, 622 and 626 on November 5, 2026. They are now in Approval while comments are resolved.
Sources
Stages come from the public CEN-CENELEC and ETSI work programs; each standard links to its record. The deadlines in M/606 are August 30, 2026, for items 1 and 15, October 30, 2026, for items 16 to 41, and October 30, 2027, for items 2 to 14. A Commission amendment that would extend the 2026 deadlines had not been adopted on the date above.
