The European Commission adopted an amendment to standardization request M/606 on November 10, 2026. Decision C(2026)7861 replaces Annex I to the original request, giving CEN, CENELEC, and ETSI more time to adopt certain standards supporting the Cyber Resilience Act.
The Commission points to developments reported by the three standards bodies in their joint report of June 3, 2026, as the reason for adjusting the 2026 deadlines.
What changes
Comparing the original annex with the amended annex, the deadlines for adoption by the European standardization organizations are:
- November 30, 2026, instead of August 30, 2026, for risk-based product security and vulnerability handling (entries 1 and 15).
- January 31, 2027, instead of October 30, 2026, for the product-specific standards (entries 16–41).
- October 30, 2027, unchanged, for the remaining horizontal product-security requirements (entries 2–14).
The decision includes a safeguard: if any of the three organizations indicates that it does not accept the amendments within one month of receiving the decision, the amendment ceases to apply and the original request continues to apply.
What this means for manufacturers
These are standards adoption deadlines, not Official Journal citation dates. Under Article 27 of the CRA, presumption of conformity depends on publication of a standard’s reference in the Official Journal and covers only the requirements addressed by that standard.
The amendment does not change the CRA’s main application date of December 11, 2027. Keep preparing your product security processes and assessments while following the standards relevant to your products.
For individual project progress, see the CRA Standards Tracker.
